XML external entity injection (ARCH2105)

Key python.security.xxe · Severity error · Category security · CWE CWE-611

XML parsers that resolve external entities or DTDs expose file reads, SSRF, and denial-of-service attacks. Disable entity resolution.

Incorrect

from lxml import etree

def parse(xml_bytes):
    parser = etree.XMLParser(resolve_entities=True)
    return etree.fromstring(xml_bytes, parser)

Correct

from lxml import etree

def parse(xml_bytes):
    parser = etree.XMLParser(resolve_entities=False, no_network=True)
    return etree.fromstring(xml_bytes, parser)

Fix

Disable external entity and DTD resolution in the parser; prefer defusedxml where possible.