XML external entity (ARCH3105)

Key typescript.security.xxe · Severity error · Category security · CWE CWE-611

Configuring an XML parser to resolve external entities lets attackers perform XXE injection for file reads, SSRF, or denial of service.

Incorrect

import { parseXml } from "libxmljs2";

// noent: true resolves external entities
const doc = parseXml(req.body, { noent: true, dtdload: true });

Correct

import { parseXml } from "libxmljs2";

// External entity and DTD loading disabled (default)
const doc = parseXml(req.body, { noent: false, nonet: true });

Fix

Disable DTD and external entity resolution; keep entity-expansion options turned off.