include::../description.adoc[]

== Noncompliant Code Example

http://xerces.apache.org/[Xerces] XercesDOMParser library:

----
#include "xercesc/parsers/XercesDOMParser.hpp"

XercesDOMParser *DOMparser = new XercesDOMParser();
// no entity reference node will be created so the entities will be expanded
DOMparser->setCreateEntityReferenceNodes(false); // Noncompliant
DOMparser->setDisableDefaultEntityResolution(false); // Noncompliant

DOMparser->parse(xmlFile);
----
http://xerces.apache.org/[Xerces] SAX2XMLReader library:

----
#include "xercesc/sax2/SAX2XMLReader.hpp"
SAX2XMLReader* reader = XMLReaderFactory::createXMLReader(); // Noncompliant: by default entities resolution is enabled so SAX2XMLReader is not safe
reader->setFeature(XMLUni::fgXercesDisableDefaultEntityResolution, false); // Noncompliant: enable resolution of entities explicitly

reader->parse(xmlFile);
----
http://xerces.apache.org/[Xerces] SAXParser library:

----
#include "xercesc/parsers/SAXParser.hpp"

SAXParser* SAXparser = new SAXParser(); // Noncompliant: by default entities resolution is enabled so SAXParser is not safe
SAXparser->setDisableDefaultEntityResolution(false); // Noncompliant: enable resolution of entities explicitly

SAXparser->parse(xmlFile);
----
http://xmlsoft.org/[LibXML2] library:

----
#include "libxml/parser.h"

xmlDocPtr doc = xmlReadFile(xmlFile, nullptr, XML_PARSE_DTDLOAD | XML_PARSE_NOENT); // Noncompliant
----

== Compliant Solution

http://xerces.apache.org/[Xerces] XercesDOMParser library:

----
#include "xercesc/parsers/XercesDOMParser.hpp"

XercesDOMParser *DOMparser = new XercesDOMParser(); // by default XercesDOMParser is safe
DOMparser->setCreateEntityReferenceNodes(true); // Compliant: explicitly make the parser safe to XXE vulnerability
DOMparser->setDisableDefaultEntityResolution(true); // Compliant

DOMparser->parse(xmlFile);
----
http://xerces.apache.org/[Xerces] SAX2XMLReader library:

----
#include "xercesc/sax2/SAX2XMLReader.hpp"

SAX2XMLReader* reader = XMLReaderFactory::createXMLReader();
reader->setFeature(XMLUni::fgXercesDisableDefaultEntityResolution, true); // Compliant

reader->parse(xmlFile);
----
http://xerces.apache.org/[Xerces] SAXParser library:

----
#include "xercesc/parsers/SAXParser.hpp"

SAXParser* SAXparser = new SAXParser();
SAXparser->setDisableDefaultEntityResolution(true); // Compliant

SAXparser->parse(xmlFile);
----
http://xmlsoft.org/[LibXML2] library:

----
#include "libxml/parser.h"

xmlDocPtr doc = xmlReadFile(xmlFile, nullptr, 0); // Compliant: safe by default since version 2.9
----

== See

* https://www.owasp.org/index.php/Top_10-2017_A4-XML_External_Entities_(XXE)[OWASP Top 10 2017 Category A4] - XML External Entities (XXE)
* https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#libxerces-c[OWASP XXE Prevention Cheat Sheet for Xerces]
* https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#libxml2[OWASP XXE Prevention Cheat Sheet for LibXML2]
* http://cwe.mitre.org/data/definitions/611.html[MITRE, CWE-611] - Information Exposure Through XML External Entity Reference
* http://cwe.mitre.org/data/definitions/827.html[MITRE, CWE-827] - Improper Control of Document Type Definition

ifdef::env-github,rspecator-view[]
'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]
