BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback
Rules / Go

XML External Entity (XXE) Injection

Description

User-controlled XML parsed without disabling external entities.

What Shoulder detects

Untrusted XML input from {source} is parsed at {sink}. If external entity processing is enabled, this can lead to XXE attacks.

How to fix

Go's encoding/xml is safe by default. Reject XML with DOCTYPE declarations.

```go
if bytes.Contains(body, []byte("<!DOCTYPE")) {
    return errors.New("DOCTYPE not allowed")
}
var data MyStruct
xml.Unmarshal(body, &data)
```

Learn more: https://shoulder.dev/learn/go/cwe-611/xxe

Applies to

Languages

References

Scan for this issue

Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=go-xxe .

Related rules