XML external entity injection (ARCH6105)

Key ruby.security.xxe · Severity error · Category security · CWE CWE-611

An XML parser configured to resolve external entities and DTDs lets attackers read files, perform SSRF, or cause denial of service.

Incorrect

doc = Nokogiri::XML(input) do |config|
  config.noent
end

Correct

doc = Nokogiri::XML(input) do |config|
  config.nonet.nonoent
end

Fix

Disable entity expansion and external DTD/network access (nonoent, nonet); reject DTDs entirely for untrusted XML.