XML external entity (ARCH7105)

Key php.security.xxe · Severity error · Category security · CWE CWE-611

An XML parser that resolves external entities lets attackers read local files, reach internal requests (SSRF), or trigger denial of service. External entity loading must be disabled.

Incorrect

<?php
$dom = new DOMDocument();
libxml_set_external_entity_loader(null);
$dom->loadXML($_POST['xml'], LIBXML_DTDLOAD | LIBXML_NOENT);
echo $dom->textContent;

Correct

<?php
$dom = new DOMDocument();
$dom->loadXML($_POST['xml'], LIBXML_NONET | LIBXML_NOENT);
// LIBXML_DTDLOAD omitted; external entity loader stays off
echo $dom->textContent;

Fix

Do not use flags like LIBXML_DTDLOAD that enable DTD/external entity loading, and keep the external entity loader disabled.