2026-09-07 · 8 min read
- xml
- security
- parsing
XML supports document type definitions and entities that can substitute text or reference external resources. Those features serve legitimate legacy formats, but unsafe defaults can turn a small untrusted document into excessive work or an unintended file or network read.
The secure configuration must cover parsing, schema validation, includes, transformation, object mapping, and serialization. Limiting only the original upload bytes does not bound the effective tree or downstream output.
Start from the smallest required feature set
Disable DTD processing when the application contract does not require it. If DTDs are required, disable unrestricted external entities and parameter entities, then allow only narrowly defined behavior through maintained parser APIs.
- Disable arbitrary file and network resolvers.
- Disable XInclude and external schema loading unless required.
- Avoid parser modes that construct application objects from type names.
- Pin and review security-relevant parser defaults on upgrades.
Bound the complete workload
Apply limits to source bytes, decoded characters, depth, element and attribute counts, namespace declarations, entity declarations, expansion work, total text, errors, parse time, transformation output, and memory where the platform exposes controls.
Reject limit violations with a generic bounded error. Do not serialize or log the complete expanded tree merely to explain why it was rejected.
Use controlled local resolution when necessary
Some established document formats rely on known public identifiers or schemas. Map those identifiers to versioned local resources through a fixed catalog rather than following locations supplied by each document.
- Reject unknown catalog identifiers.
- Package schemas with controlled application releases.
- Apply the same limits during validation and transformation.
- Keep parser workers away from credentials and unnecessary networks.
Maintain harmless conformance tests
Use Flashman's XML formatter for small synthetic documents, units converter for explicit budgets, diff for parser configurations, hash to label public fixtures, and JSON formatter for sanitized effective data. These browser tools do not prove server parser safety.
Test DTD rejection, bounded internal entities, blocked external references, deep and broad trees, large attributes, schema imports, XInclude, transformations, malformed input, cancellation, and every deployed parser version.