How to fix XXE injection

What an attacker can do

The concrete impact of leaving XXE unpatched.

How to fix XXE

6 ordered steps. Apply them in order — each builds on the previous.

1. 1

   Disable external entity resolution at the parser level

   The single most effective fix. Configure your XML parser to refuse external entities — every parser supports this, but each uses different syntax.

   This is the canonical fix. Disable external entities (DTD, parameter entities, external general entities) at parser construction. Also disable network access if your parser exposes that toggle. The exact API varies per language — see code examples for the 6 most common parsers below.

   Python / lxmlStep 1

   from lxml import etree
   
   # VULNERABLE — defaults
   parser = etree.XMLParser()  # external entities ENABLED
   
   # SECURE
   parser = etree.XMLParser(
       resolve_entities=False,  # disable entity resolution
       no_network=True,         # block all network access
       dtd_validation=False,    # disable DTD validation
       load_dtd=False,          # don't fetch DTD
       huge_tree=False,         # cap tree size — billion laughs defense
   )
   tree = etree.parse(xml_file, parser)

2. 2

   Same fix in Java JAXP / DocumentBuilderFactory

   Java is the most XXE-vulnerable language by default. JAXP, SAX, DOM, StAX all need explicit hardening — at every parser instantiation in your codebase.

   Java's XML stack (JAXP) ships with external entities ON by default and the OWASP-recommended settings list is long. Use a centralized helper that applies all hardenings at once and use that helper EVERYWHERE you parse XML. Audit every DocumentBuilderFactory.newInstance() in your codebase.

   JavaStep 2

   DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
   
   // Disable DTDs entirely (best defense)
   dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
   
   // Belt and suspenders if DTDs can't be disabled:
   dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
   dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
   dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
   dbf.setXIncludeAware(false);
   dbf.setExpandEntityReferences(false);
   
   DocumentBuilder builder = dbf.newDocumentBuilder();
   Document doc = builder.parse(xmlInput);

3. 3

   Same fix in .NET XmlReader / XmlDocument

   .NET defaults shipped XXE-vulnerable until .NET 4.5.2+, and lots of legacy code is still on older targets. Set DtdProcessing.Prohibit and an XmlResolver.

   Modern .NET (4.5.2+) defaults to safe behavior, but legacy apps or code paths instantiating XmlReader/XmlDocument with custom settings often regress. Set DtdProcessing = DtdProcessing.Prohibit and an explicit null XmlResolver to block external resolution.

   C# / .NETStep 3

   // XmlReader (preferred — explicit and modern)
   var settings = new XmlReaderSettings {
       DtdProcessing = DtdProcessing.Prohibit, // block DTDs entirely
       XmlResolver = null,                     // refuse external resolution
   };
   using (var reader = XmlReader.Create(stream, settings)) {
       // safe parsing
   }
   
   // XmlDocument (legacy — also safe with these settings)
   var doc = new XmlDocument {
       XmlResolver = null,
   };
   doc.Load(xmlInput);

4. 4

   Disable XXE in PHP libxml-based parsers

   PHP's DOMDocument, SimpleXML, XMLReader all use libxml2. Older PHP defaults to external-entity-on; PHP 8+ flipped to safer defaults but legacy code still calls libxml_disable_entity_loader without realizing it's deprecated.

   On PHP 8+, libxml defaults are XXE-safe. On older PHP, you NEED libxml_disable_entity_loader(true) before parsing. PHP 8 deprecated that function (because the default is now safe), but if you support older PHP you still need both. The LIBXML_NOENT flag specifically ENABLES entities — never use it.

   PHPStep 4

   <?php
   // PHP 8.0+: libxml is safe by default. PHP < 8.0: explicit fix required.
   if (PHP_MAJOR_VERSION < 8) {
       libxml_disable_entity_loader(true);
   }
   
   $doc = new DOMDocument();
   // LIBXML_NOENT ENABLES entity resolution — NEVER use it
   $doc->loadXML($xmlInput, LIBXML_DTDLOAD | LIBXML_DTDATTR);
   
   // Better: use the safer parse-only flags
   $doc->loadXML($xmlInput); // no flags = uses safe defaults

5. 5

   Disable XXE in Node.js XML libraries

   Node lacks a built-in XML parser, so projects pull in xml2js, fast-xml-parser, libxmljs, sax. Each has its own XXE story — most are safe by default but check.

   xml2js: doesn't process external entities by default — safe. fast-xml-parser: safe by default; the processEntities option must be off (which it is). libxmljs (which wraps libxml2): inherits libxml2's UNSAFE defaults — must pass noent: false, noNet: true. sax-js: doesn't process external entities — safe. The takeaway: stick to xml2js or fast-xml-parser; if you need libxmljs, harden it.

   Node.js / libxmljsStep 5

   const libxmljs = require('libxmljs');
   
   // VULNERABLE — defaults inherited from libxml2
   const doc = libxmljs.parseXml(xmlInput);
   
   // SECURE
   const doc = libxmljs.parseXml(xmlInput, {
     noent: false,    // do NOT replace entities
     noNet: true,     // disable network access for entity resolution
     dtdload: false,  // do NOT fetch DTDs
     dtdvalid: false, // do NOT validate against DTD
     doctype: false,  // disallow DOCTYPE declarations entirely
   });

6. 6

   Block XXE at upload boundary — reject XML containing DOCTYPE

   Defense in depth. If your endpoint receives uploaded XML/SVG/DOCX, scan for <!DOCTYPE before parsing. Reject anything containing it.

   Most legitimate XML in 2026 doesn't contain DOCTYPE declarations — only attackers add them to inject entities. Scanning the raw byte stream for <!DOCTYPE BEFORE parsing catches XXE attempts at the boundary, even if a parser somewhere downstream is misconfigured. This is belt-and-suspenders defense — pair with step 1 always.

   TypeScriptStep 6

   function rejectIfXxeAttempt(xml: string): void {
     // Strip BOM and whitespace before checking
     const trimmed = xml.replace(/^\uFEFF?\s*/, '');
   
     if (/<!DOCTYPE/i.test(trimmed)) {
       throw new Error('XML containing DOCTYPE declarations is not accepted');
     }
     if (/<!ENTITY/i.test(trimmed)) {
       throw new Error('XML containing ENTITY declarations is not accepted');
     }
   }
   
   // In your handler
   app.post('/api/import/xml', async (req, res) => {
     rejectIfXxeAttempt(req.body); // boundary check
     const parsed = safeParser.parseString(req.body); // hardened parser too
     res.json(parsed);
   });