Resolving XML external entity in user-controlled data¶
ID: swift/xxeKind: path-problemSecurity severity: 9.1Severity: errorPrecision: highTags: - security - external/cwe/cwe-611 - external/cwe/cwe-776 - external/cwe/cwe-827Query suites: - swift-code-scanning.qls - swift-security-extended.qls - swift-security-and-quality.qls
Click to see the query in the CodeQL repository
Parsing untrusted XML files with a weakly configured XML parser may lead to an XML External Entity (XXE) attack. This type of attack uses external entity references to access arbitrary files on a system, carry out denial-of-service attacks, or server-side request forgery. Even when the result of parsing is not returned to the user, out-of-band data retrieval techniques may allow attackers to steal sensitive data. Denial of services can also be carried out in this situation.
Recommendation¶
The easiest way to prevent XXE attacks is to disable external entity handling when parsing untrusted data. How this is done depends on the library being used. Note that some libraries, such as recent versions ofXMLParser, disable entity expansion by default, so unless you have explicitly enabled entity expansion, no further action needs to be taken.
Example¶
The following example uses theXMLParser class to parse a stringdata. If that string is from an untrusted source, this code may be vulnerable to an XXE attack, since the parser is also setting itsshouldResolveExternalEntities option totrue:
letparser=XMLParser(data:remoteData)// BAD (parser explicitly enables external entities)parser.shouldResolveExternalEntities=true
To guard against XXE attacks, theshouldResolveExternalEntities option should be left unset or explicitly set tofalse.
letparser=XMLParser(data:remoteData)// GOOD (parser explicitly disables external entities)parser.shouldResolveExternalEntities=false
References¶
Timothy D. Morgan and Omar Al IbrahimXML Schema, DTD, and Entity Attacks: A Compendium of Known Techniques.
Timur Yunusov, Alexey Osipov:XML Out-Of-Band Data Retrieval.
Common Weakness Enumeration:CWE-611.
Common Weakness Enumeration:CWE-776.
Common Weakness Enumeration:CWE-827.