rspec/rules/S2755/cfamily/rule.adoc

== Why is this an issue?

include::../description.adoc[]

=== Noncompliant code example

http://xerces.apache.org/[Xerces] XercesDOMParser library:

[source,cpp]
----
#include "xercesc/parsers/XercesDOMParser.hpp"

XercesDOMParser *DOMparser = new XercesDOMParser();
// no entity reference node will be created so the entities will be expanded
DOMparser->setCreateEntityReferenceNodes(false); // Noncompliant
DOMparser->setDisableDefaultEntityResolution(false); // Noncompliant

DOMparser->parse(xmlFile);
----
http://xerces.apache.org/[Xerces] SAX2XMLReader library:

[source,cpp]
----
#include "xercesc/sax2/SAX2XMLReader.hpp"
SAX2XMLReader* reader = XMLReaderFactory::createXMLReader(); // Noncompliant: by default entities resolution is enabled so SAX2XMLReader is not safe
reader->setFeature(XMLUni::fgXercesDisableDefaultEntityResolution, false); // Noncompliant: enable resolution of entities explicitly

reader->parse(xmlFile);
----
http://xerces.apache.org/[Xerces] SAXParser library:

[source,cpp]
----
#include "xercesc/parsers/SAXParser.hpp"

SAXParser* SAXparser = new SAXParser(); // Noncompliant: by default entities resolution is enabled so SAXParser is not safe
SAXparser->setDisableDefaultEntityResolution(false); // Noncompliant: enable resolution of entities explicitly

SAXparser->parse(xmlFile);
----
http://xmlsoft.org/[LibXML2] library:

[source,cpp]
----
#include "libxml/parser.h"

xmlDocPtr doc = xmlReadFile(xmlFile, nullptr, XML_PARSE_DTDLOAD | XML_PARSE_NOENT); // Noncompliant
----

=== Compliant solution

http://xerces.apache.org/[Xerces] XercesDOMParser library:

[source,cpp]
----
#include "xercesc/parsers/XercesDOMParser.hpp"

XercesDOMParser *DOMparser = new XercesDOMParser(); // by default XercesDOMParser is safe
DOMparser->setCreateEntityReferenceNodes(true); // Compliant: explicitly make the parser safe to XXE vulnerability
DOMparser->setDisableDefaultEntityResolution(true); // Compliant

DOMparser->parse(xmlFile);
----
http://xerces.apache.org/[Xerces] SAX2XMLReader library:

[source,cpp]
----
#include "xercesc/sax2/SAX2XMLReader.hpp"

SAX2XMLReader* reader = XMLReaderFactory::createXMLReader();
reader->setFeature(XMLUni::fgXercesDisableDefaultEntityResolution, true); // Compliant

reader->parse(xmlFile);
----
http://xerces.apache.org/[Xerces] SAXParser library:

[source,cpp]
----
#include "xercesc/parsers/SAXParser.hpp"

SAXParser* SAXparser = new SAXParser();
SAXparser->setDisableDefaultEntityResolution(true); // Compliant

SAXparser->parse(xmlFile);
----
http://xmlsoft.org/[LibXML2] library:

[source,cpp]
----
#include "libxml/parser.h"

xmlDocPtr doc = xmlReadFile(xmlFile, nullptr, 0); // Compliant: safe by default since version 2.9
----

== Resources

* https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[OWASP Top 10 2021 Category A5] - Security Misconfiguration
* https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)[OWASP Top 10 2017 Category A4] - XML External Entities (XXE)
* https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#libxerces-c[OWASP XXE Prevention Cheat Sheet for Xerces]
* https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#libxml2[OWASP XXE Prevention Cheat Sheet for LibXML2]
* https://cwe.mitre.org/data/definitions/611[MITRE, CWE-611] - Information Exposure Through XML External Entity Reference
* https://cwe.mitre.org/data/definitions/827[MITRE, CWE-827] - Improper Control of Document Type Definition

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

include::../highlighting.adoc[]

'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]