{"title":"XML External Entity (XXE) Injection via lxml Entity Resolution","language":"Python","severity":"Critical","cwe":"CWE-611","source_lines":[4],"flow_lines":[4,5,6],"sink_lines":[6],"vulnerable_code":"from lxml import etree\nimport requests\n\ndef process_iot_device_config(config_xml_url):\n    response = requests.get(config_xml_url)\n    parser = etree.XMLParser(resolve_entities=True, no_network=False)\n    device_config = etree.fromstring(response.content, parser)\n    device_id = device_config.find('.//deviceID').text\n    firmware_ver = device_config.find('.//firmware').text\n    telemetry_endpoint = device_config.find('.//telemetryURL').text\n    return {'id': device_id, 'firmware': firmware_ver, 'endpoint': telemetry_endpoint}","explanation":"The code creates an XMLParser with resolve_entities=True and no_network=False, then parses untrusted XML content from a remote URL. This configuration allows XXE attacks where malicious XML can define external entities to read local files, perform SSRF attacks, or cause denial of service through entity expansion attacks.","remediation":"The fix disables external entity resolution by setting resolve_entities=False, blocks network access during parsing with no_network=True, and disables DTD loading and validation with dtd_validation=False and load_dtd=False. This prevents attackers from injecting malicious external entities that could read local files, perform SSRF attacks, or cause denial of service.","secure_code":"from lxml import etree\nimport requests\n\ndef process_iot_device_config(config_xml_url):\n    response = requests.get(config_xml_url)\n    parser = etree.XMLParser(resolve_entities=False, no_network=True, dtd_validation=False, load_dtd=False)\n    device_config = etree.fromstring(response.content, parser)\n    device_id = device_config.find('.//deviceID').text\n    firmware_ver = device_config.find('.//firmware').text\n    telemetry_endpoint = device_config.find('.//telemetryURL').text\n    return {'id': device_id, 'firmware': firmware_ver, 'endpoint': telemetry_endpoint}"}