XML External Entity (XXE) Injection

Description

Detects XML parsing with external entity processing enabled. XXE attacks allow attackers to read local files, perform SSRF, or cause denial of service. Always disable external entity processing when parsing untrusted XML.

How to fix

Use defusedxml instead of standard XML parsers for untrusted input.

```python
import defusedxml.ElementTree as ET
from flask import request, jsonify

@app.route('/api/xml', methods=['POST'])
def parse_xml():
    try:
        root = ET.fromstring(request.data)
        return jsonify({'name': root.find('name').text})
    except ET.ParseError:
        return jsonify({'error': 'Invalid XML'}), 400
```

Learn more: https://shoulder.dev/learn/python/cwe-611/xxe

Applies to

Languages

🐍 Python

Frameworks

django flask fastapi

References

Documentation ↗ OWASP ↗ Learn about CWE-611

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=python-xxe .