XML External Entity (XXE) Injection
Description
User-controlled XML parsed without disabling external entities.
What Shoulder detects
How to fix
Go's encoding/xml is safe by default. Reject XML with DOCTYPE declarations.
```go
if bytes.Contains(body, []byte("<!DOCTYPE")) {
return errors.New("DOCTYPE not allowed")
}
var data MyStruct
xml.Unmarshal(body, &data)
```
Learn more: https://shoulder.dev/learn/go/cwe-611/xxe
Applies to
Languages
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=go-xxe .