# Improper Restriction of XML External Entity Reference (CWE-611)

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

**Stack:** Go

- Prevalence: Średnia Pokryto 3 języków
- Impact: Wysoki 3 reguł o wysokim poziomie
- Prevention: Udokumentowane 3 przykładów poprawek

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

XML External Entity (XXE) attacks exploit features of XML parsers to read local files, perform server-side request forgery, or cause denial of service.

## Prevention

Strategie zapobiegania dla XML External Entity (XXE) oparte na 1 regułach detekcji Shoulder.

### Go

Go's encoding/xml is safe by default; reject XML with DOCTYPE declarations as defense in depth

## Consequences

- Odczyt danych aplikacji
- Odczyt plików lub katalogów
- DoS

## Mitigations

- Wyłącz przetwarzanie encji zewnętrznych w parserach XML
- Tam, gdzie to możliwe, używaj prostszych formatów danych, takich jak JSON
- Waliduj i sanitizuj dane wejściowe XML

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Go (1 rules)

- **XML External Entity (XXE) Injection** [HIGH]: User-controlled XML parsed without disabling external entities.
  - Remediation: Go's encoding/xml is safe by default. Reject XML with DOCTYPE declarations.

```go
if bytes.Contains(body, []byte("<!DOCTYPE")) {
    return errors.New("DOCTYPE not allowed")
}
var data MyStruct
xml.Unmarshal(body, &data)
```

Learn more: https://shoulder.dev/learn/go/cwe-611/xxe