Metadata

ID: ruby-security/xxe-nokogiri

Language: Ruby

Severity: Warning

Category: Security

CWE: 611

Description

This rule addresses the prevention of XML External Entity (XXE) with the Nokogiri library.

To avoid XXE vulnerabilities, developers should disable the processing of external entities and external DTDs when parsing XML. In Ruby, when using the Nokogiri library, this can be achieved by configuring the parser with cfg.strict.nonet and removing any external subsets from the document.

A secure approach involves parsing XML with a block that sets these options, for example: doc = Nokogiri::XML(params[:xml]) do |cfg| cfg.strict.nonet end followed by doc.remove_external_subset. This ensures that external resources are not loaded or processed, mitigating the risk of XXE attacks. Adopting these practices helps maintain the confidentiality and integrity of your application’s data.

Non-Compliant Code Examples

doc = Nokogiri::XML(params[:xml]) # can fetch file:/// or http://…
val = doc.at("//token").text

Compliant Code Examples

doc = Nokogiri::XML(params[:xml]) do |cfg|
  cfg.strict.nonet
end
doc.remove_external_subset
doc.xpath("//token").text

Integraciones sin problemas. Prueba Datadog Code Security

Datadog Code Security