Protecting against XML Entity Expansion attacks

The post argues that input validation is a basic defense and that untrusted XML should be treated as malicious unless proven otherwise. It describes how a document that looks small and well formed can expand into an enormous amount of text during parsing and cause denial of service.

Reading notes

#

• Input validation is presented as the basic defense against security attacks, and all uncontrolled input should be treated as malicious unless proven otherwise.
• The author describes an XML file received from the Internet that was checked with schema validation and a digital signature, yet still exposed a missed attack class.
• Untrusted XML should never be loaded into XmlDocument as the first step, because parsing alone can trigger a meltdown.
• The example shows nested custom entities that expand repeatedly until a small XML document becomes extremely large.
• The impact described is denial of service through heavy CPU consumption rather than data theft.
• The suggested defense is to use XmlReader before XmlDocument, or instead of it when a fully parsed document is not needed.
• The sample configuration sets XmlResolver to null and MaxCharactersInDocument to 10000.
• If parsing with XmlReader finishes without XmlException, the document is treated as safe to parse further, but normal validation and encoding still remain necessary.