Metadata

ID: python-security/xxe-injection

Language: Python

Severity: Warning

Category: Security

CWE: 611

Description

This rule detects potential XML External Entity (XXE) vulnerabilities in Python code. XXE attacks occur when an application parses XML input containing external entity references, which can lead to data exposure, denial of service, or other security issues. The vulnerability arises when untrusted XML content is processed without proper configuration to disable external entity resolution.

To avoid this vulnerability, always use safe XML parsing practices. For example, avoid parsing XML from untrusted sources directly with default settings, such as ElementTree.parse(content). Instead, parse XML from trusted file paths or configure the parser to disable external entity resolution. Using libraries or methods that do not process external entities by default is also recommended.

Non-Compliant Code Examples

import xml
import xml.etree import ElementTree

tree = ElementTree.parse(f"${something}")

import xml

tree = xml.etree.ElementTree.parse(content)

import xml
import xml.etree import ElementTree

tree = ElementTree.parse(content)

Compliant Code Examples

import xml
import xml.etree import ElementTree

tree = ElementTree.parse('myfile.xml')
tree = ElementTree.parse("myfile.xml")