This rule addresses the prevention of XML External Entity (XXE) with the Nokogiri library.
To avoid XXE vulnerabilities, developers should disable the processing of external entities and external DTDs when parsing XML. In Ruby, when using the Nokogiri library, this can be achieved by configuring the parser with cfg.strict.nonet and removing any external subsets from the document.
A secure approach involves parsing XML with a block that sets these options, for example: doc = Nokogiri::XML(params[:xml]) do |cfg| cfg.strict.nonet end followed by doc.remove_external_subset. This ensures that external resources are not loaded or processed, mitigating the risk of XXE attacks. Adopting these practices helps maintain the confidentiality and integrity of your application’s data.
Non-Compliant Code Examples
doc=Nokogiri::XML(params[:xml])# can fetch file:/// or http://…val=doc.at("//token").text
