XML — XXE entity expansion attack blocked

XML parser rejects an entity expansion because the document defines recursive or billion-laughs entities that could exhaust memory, triggering XXE protection.

advanceddebuggingxmlsecurity

Symptoms

error: Entity expansion limit exceeded
Parser hangs or crashes on a crafted XML input
Security scanner flags XXE vulnerability

Possible causes

The XML input defines recursive entities for a billion-laughs attack
External entity references point to local files or URLs
The parser has XXE protection enabled and blocks the expansion

Diagnosis steps

Check the XML for entity definitions

grep -n "<!ENTITY" input.xml

Interpretation

Recursive or external entities indicate an XXE payload.

Verify parser XXE settings

grep -n "entityExpansionLimit|disallowDoctype" src/xml-parser.ts

Interpretation

Confirm the parser blocks entity expansion and external entities.

Root cause

The XML document contains entity definitions that expand recursively or reference external resources, which the parser blocks to prevent XXE attacks.

Fix

Disable DTD and external entities in the parser, set a low entity expansion limit, and reject documents with DOCTYPE declarations from untrusted sources.

Verify the fix

Parse a benign XML and confirm it succeeds; parse a billion-laughs payload and confirm it is rejected without memory exhaustion.

Symptom walkthrough

XML parser rejects an entity expansion because the document defines recursive or billion-laughs entities that could exhaust memory, triggering XXE protection. The error appears in production but may not surface in local development because the conditions that trigger it depend on the deployment environment or runtime configuration. Understanding the full symptom set helps distinguish this issue from similar errors.

Diagnosis in practice

Follow the diagnosis steps in the frontmatter to isolate the cause. Each step includes a command and an interpretation of the output. The goal is to narrow down whether the issue is in the configuration, the runtime, or the application code. Reproduce the error in a minimal setup before applying a fix.

Root cause

The XML document contains entity definitions that expand recursively or reference external resources, which the parser blocks to prevent XXE attacks.

Fix

Disable DTD and external entities in the parser, set a low entity expansion limit, and reject documents with DOCTYPE declarations from untrusted sources. After applying the fix, monitor the system to confirm the error does not recur under load or in different environments.

Verification

Parse a benign XML and confirm it succeeds; parse a billion-laughs payload and confirm it is rejected without memory exhaustion. If the verification passes, the fix is confirmed; if not, re-examine the diagnosis steps for missed contributing factors.

Diagnostic commands

Run these commands to reproduce and diagnose the issue:

grep -n "<!ENTITY" input.xml
grep -n "entityExpansionLimit|disallowDoctype" src/xml-parser.ts