Unsafe lxml XMLParser options

Description

Enabling external entity resolution, DTD loading, network access or excessive tree sizes in lxml.etree.XMLParser can expose applications processing untrusted XML to XXE, SSRF, local file disclosure or memory exhaustion.

Potential impact

XML external entities may expose local files or internal network resources.
Loading DTDs and network resources may enable SSRF.
With huge_tree=True, large XML input may exhaust memory.

Remediation

Explicitly set resolve_entities=False, load_dtd=False and no_network=True.
Avoid huge_tree=True unless it is required.
Process untrusted XML only with hardened parser settings.
Where practical, consider a simpler data format such as JSON instead of XML.

Examples

Before

python

from flask import request
from lxml import etree

def bad_parse():
    xml_body = request.get_data()
    parser = etree.XMLParser(resolve_entities=True, load_dtd=True)
    return etree.fromstring(xml_body, parser=parser)

After

python

from flask import request
from lxml import etree

def safe_parse():
    xml_body = request.get_data()
    parser = etree.XMLParser(resolve_entities=False, load_dtd=False, no_network=True)
    return etree.fromstring(xml_body, parser=parser)

Explanation:

Before: Processes user-supplied XML with external entity resolution and DTD loading enabled.
After: Uses a parser with external entities, DTD loading and network access disabled.

References

CWE-611