REFERENCE GUIDE
XML external entities and parser resource resolution
An XML parser can process a document type definition and resolve external entities into document content.
Also known as: XXE
Mechanism
An XML parser can process a document type definition and resolve external entities into document content. XXE arises when untrusted XML controls resolution of files or network resources. Entity support, DTD processing, and resolver policy vary by parser and configuration. An XML-looking response does not prove that the submitted input reaches an entity-capable parser.
Practical method
Find the accepted XML content type and capture a valid baseline document. Test an internal entity in the local fixture first, then a harmless external fixture if the parser accepts declarations. Observe whether the result is reflected or only produces a callback. Inventory secondary parsers in uploads and document conversions.
<!DOCTYPE note [<!ENTITY marker "lab-value">]>
<note>▮</note>Interpreting evidence
An expanded internal entity demonstrates DTD interpretation but not external access. Establish the resolver capability separately and distinguish file retrieval from an outbound request.
Pitfalls and limits
Parameter entities and alternate parser paths have different rules. Network callbacks may come from a scanner or converter rather than the main application. Disable external resolution instead of relying on a string filter for DOCTYPE.