# Improper Restriction of XML External Entity Reference (CWE-611)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

**Stack:** JavaScript

- Prevalence: मध्यम 3 भाषाएँ कवर की गईं
- Impact: उच्च 3 उच्च गंभीरता वाले नियम
- Prevention: प्रलेखित 3 फिक्स उदाहरण

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

XML External Entity (XXE) attacks exploit features of XML parsers to read local files, perform server-side request forgery, or cause denial of service.

## Prevention

1 Shoulder डिटेक्शन नियमों पर आधारित XML External Entity (XXE) के लिए रोकथाम रणनीतियाँ।

### JavaScript

Disable external entity processing in XML parsers or use JSON instead of XML

## Warning Signs

- [HIGH] unsafe XML parsing that could allow XML External Entity (XXE) attacks

## Consequences

- एप्लिकेशन डेटा पढ़ना
- फ़ाइलें या डायरेक्टरीज़ पढ़ना
- DoS

## Mitigations

- XML पार्सरों में बाहरी एंटिटी प्रसंस्करण को निष्क्रिय करें
- जब संभव हो, JSON जैसे कम जटिल डेटा प्रारूपों का उपयोग करें
- XML इनपुट को सत्यापित और सैनिटाइज़ करें

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Javascript (1 rules)

- **XML External Entity (XXE) Injection** [HIGH]: Detects unsafe XML parsing that could allow XML External Entity (XXE) attacks.
XXE can lead to file disclosure, SSRF, denial of service, and other attacks.
  - Remediation: Disable external entity processing or use JSON instead of XML.

```javascript
const { XMLParser } = require('fast-xml-parser');
const parser = new XMLParser({ processEntities: false });
const result = parser.parse(xmlData);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-611/xxe

### Typescript (1 rules)

- **XML External Entity (XXE) Injection** [HIGH]: Detects unsafe XML parsing that could allow XML External Entity (XXE) attacks.
XXE can lead to file disclosure, SSRF, denial of service, and other attacks.
  - Remediation: Disable external entity processing or use JSON instead of XML.

```javascript
const { XMLParser } = require('fast-xml-parser');
const parser = new XMLParser({ processEntities: false });
const result = parser.parse(xmlData);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-611/xxe