XML external entity (XXE) prevention

XML External Entity injection (CWE-611, OWASP A05 Security Misconfiguration) enables attackers to read arbitrary files from the server filesystem, perform SSRF, and in some parsers execute server-side code — all via a crafted XML payload. NIST 800-53 SI-10 requires input validation. Any XML parser that processes DTDs and external entities by default is vulnerable to a trivially constructed payload: <!DOCTYPE foo [<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]>. This affects SAML authentication flows, SOAP integrations, SVG uploads, and any endpoint that parses XML from external sources.

Configure every XML parser to disable external entity resolution and DTD processing. For fast-xml-parser:

import { XMLParser } from 'fast-xml-parser'

const parser = new XMLParser({
  processEntities: false,  // Disable all entity processing
  ignoreAttributes: false,
})
const result = parser.parse(xmlString)

For SAML flows, use a hardened library (e.g., samlify with schema validation enabled) rather than a general-purpose XML parser. Audit every dependency that lists xmldom, libxmljs, or sax — these libraries have different defaults and may need explicit configuration in lib/xml-parser.ts.