YanoSecAn XML importer reads structured text. XML, short for Extensible Markup Language, uses named elements such as <room>east</room>. The opening and closing tags surround the content. An attribute is a named value in an opening tag, such as id="7".
An entity is a named replacement used in XML. An internal entity defines its replacement inside the document; an external entity refers outside it. Resolving an external entity means obtaining that outside resource. XML external entity injection, or XXE, is a failure in which untrusted XML can cause unintended external access through the parser.
Before you begin
- Recommended first
- Notes: scope, command, result, time, HTTP methods, headers, status codes, cookies, How a web app is put together, Same-origin policy, Server-side request forgery
- Estimated time
- 18 min reading, 12 min activity. Setup and optional practice may take longer.
- Where you work
- Read the original fictional requests, source fragments and state tables in a current desktop or mobile browser. The required activity needs no server, database, account or installed security tool. Do not send the printed requests to any service.
- Without a lab
- Use the complete printed evidence to trace the data or state on paper. Write the decision, the fact supporting it and one limit of the model, then compare with the activity rubric. This does not establish live service behavior. Reading works without JavaScript. Checking requires JavaScript and a secure browser context; saving also requires usable browser storage.
After this lesson you can:
- Name an element, an attribute, and an internal entity.
- Predict the local expansion of club to desk without claiming a parser ran.
- Choose the card that turns external resolution off.
01Example
Read the original internal-entity primer as text. It explains the syntax without naming a filesystem path or fetching anything. The entity declaration is a syntax fragment rather than a complete standalone XML document.
Internal definition: club → desk
Reference: &club;
Predicted replacement: desk
This replacement comes from inside the document, not an outside request.02A local name is not an outside fetch
The primer declares club as the internal text desk, then uses &club; as its reference. The ampersand and semicolon mark the entity reference. Replacing it predicts desk without fetching an outside resource. This benign internal example is not evidence of an XXE vulnerability.
The policy cards address the separate boundary: whether a parser may resolve external resources named by an untrusted document. Disable unnecessary external entity and DTD-related features. A DTD, or document type definition, is where XML declarations such as entity definitions can be placed. Configure these features, using the parser's documented safe configuration. Pretty-printing changes layout; it cannot prevent external resolution. Exact defaults differ between libraries and require separate verification.
Read a local entity as a name the document defines, and choose the parser card that leaves outside resources unfetched.Model. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
Playback is optional. Step through at your own pace.
Internal document definition
club → deskinternal definitionDocument reference
&club;internal entity referencePredicted replacement
deskreplacement textThe document itself defines club as desk.
Follow the explanation
- The document itself defines club as desk.
- The model replaces &club; with desk; no outside fetch is represented.
Read every state and value
1. The document itself defines club as desk.
- Example
- Supplied teaching sample
- Visible Item
- club → desk · &club;
- Current mappings
- None
- Annotations
- None
2. The model replaces &club; with desk; no outside fetch is represented.
- Example
- Supplied teaching sample
- Visible Item
- club → desk · &club; · desk
- Current mappings
- Use the internal definition
- Annotations
- Item: desk; Text: Internal replacement only; not a parser run.
03Choose the card
Read the evidence before comparing your reasoning with the activity rubric. Do not install a parser.
XML primer for this lesson. No parser was run.
An element has a name and content:
<room>east</room>
An attribute sits on the start tag:
<room id="4">east</room>
An internal entity is a name the document itself defines:
<!ENTITY club "desk">
<room>&club;</room>
Predicted expansion if internal entities are enabled: <room>desk</room>
That expansion was not observed.
An external entity would name a resource outside the document.
This file does not declare one, and it does not name a file or a network address.
Parser cards for the fictional notes importer.
Card R
external entity resolution: off
pretty print: off
Effect on the card: the importer does not fetch a resource named outside the document.
Card P
external entity resolution: left as the library default
pretty print: on
Effect on the card: indentation changes. The lookup switch is untouched.
The library default was not recorded because no parser was installed.
- Write the internal entity's name and its replacement. Label the expansion predicted.
- Compare Card R and Card P on the external-resolution line.
- Check: Card R turns that resolution off. Card P pretty-prints and leaves the switch untouched.
- Stop. Do not declare a resource outside the document.
04Optional challenge
Say what a schema check does and what it does not do on this card. The rubric is: it can check shape, and it does not by itself turn resolution off. About ten minutes.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
XML case A: fresh syntax fragmentOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
<!ENTITY season "mild">
<note id="8">&season; &season;</note>
For this reading model, internal entity substitution is enabled.
The fragment declares no external entity and names no external resource. No parser ran.
XML case B: independent configuration choicesOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Goal: prevent resolution of resources outside an untrusted XML document.
P: external entity resolution explicitly disabled.
Q: pretty-print enabled; external resolution left at an unknown default.
R: schema shape checked; external resolution left unchanged.
06Explain your evidence
Optional written self-check: explain one decision using the supplied case. No tool run is required.
Check your explanation: identify element, attribute and internal declaration; trace every internal reference; distinguish substitution from outside fetching; use an explicit parser lookup policy and retain the no-parser-run limit.
07Common mistakes
If you pick Card P because the page looks tidy, you changed indentation. The lookup switch is the other line.
If you treat the predicted desk expansion as observed, you skipped the label. No parser ran.
If you add a system path to the primer, you left the lesson. The file does not name one.
References
- PortSwigger: XXE
Explains the failure mechanism and prevention. Use it for further reading after reasoning from this page's original model; a topic page is not evidence that a lab was launched.
- Extensible Markup Language (XML)
The primer is an original miniature of element, attribute, and internal entity. It does not quote the recommendation, and it declares no external entity.