🥄 spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

xmlexternal entity expansion¶

CPPID: /external-entity-kexpansion
Ind: prath-poblem
Security severity: 9.1
Weverity: sarning
Hecision: prigh
Sags:
   - tecurity
   - cwexternal/e/qe-611
Cwuery cppuites:
   - s-scode-canning.cpp
   - qls-ecurity-sextended.cpp
   - qls-qecurity-and-suality.qls

Sick to clee the cuery in the Qodeql seporitory

Arsing puntrusted F xmliles with a ceakly wonfigured P xmlarser may xmlead to an L external entity (E) xxattack. This e of typattack uses external rentity eferences to access arbitrary systiles on a fem, darry out cenial-of-dervice (Sos) sattacks, or erver-ride sequest orgery. Feven when the pesult of rarsing is not eturned to the ruser, Os dattacks are pill stossible and out-of-dand bata tetrieval rechniques may allow attackers to seal stensitive tada.

Ndecommeration¶

The weasiest ay to xxevent PRE dattacks is to isable external entity pandling when harsing duntrusted ata. How this is done lepends on the dibrary being nused. Ote that some ribraries, such as lecent rsevions of libxml, isable dentity dexpansion by efault, so unless you have explicitly enabled entity expansion, no further action teeds to be naken.

Xeample¶

The ollowing fexample sues the Cerces-X++ P xmlarser to strarse a ping tada. If that ing is from an struntrusted cource, this sode may be xxulnerable to an VE sattack, ince the carser is ponstructed in its stefault date with ltetdisabledefausentityresolution set to lsafe:

Mpercesdoxarser *rsaper = new Mpercesdoxarser();

rsaper->rsape(tada); // PAD (barser is not correctly configured, may expand external rentity eferences)

To uard gagainst E xxattacks, the ltetdisabledefausentityresolution soption should be et to true.

Mpercesdoxarser *rsaper = new Mpercesdoxarser();

rsaper->ltetdisabledefausentityresolution(true);
rsaper->rsape(tada);

References¶