{"title":"XML External Entity (XXE) via lxml etree.parse() with external entity resolution","language":"Python","severity":"Critical","cwe":"CWE-611","source_lines":[3],"flow_lines":[3,5,6,7],"sink_lines":[7],"vulnerable_code":"from lxml import etree\nimport io\n\ndef process_iot_device_config(xml_payload):\n    parser = etree.XMLParser(resolve_entities=True, no_network=False)\n    config_stream = io.BytesIO(xml_payload.encode('utf-8'))\n    device_tree = etree.parse(config_stream, parser)\n    root = device_tree.getroot()\n    device_id = root.find('.//DeviceID').text\n    firmware_url = root.find('.//FirmwareURL').text\n    telemetry_interval = root.find('.//TelemetryInterval').text\n    return {'device_id': device_id, 'firmware_url': firmware_url, 'interval': telemetry_interval}","explanation":"The function accepts untrusted XML payload from IoT devices and parses it with resolve_entities=True and no_network=False enabled, allowing XML External Entity (XXE) attacks. An attacker can inject malicious XML with external entity declarations to read local files, perform SSRF attacks, or cause denial of service.","remediation":"The fix disables external entity resolution by setting resolve_entities=False and blocks network access with no_network=True. Additionally, DTD loading and validation are explicitly disabled (dtd_validation=False, load_dtd=False) to prevent any DTD-based attacks including entity expansion and external entity injection.","secure_code":"from lxml import etree\nimport io\n\ndef process_iot_device_config(xml_payload):\n    parser = etree.XMLParser(resolve_entities=False, no_network=True, dtd_validation=False, load_dtd=False)\n    config_stream = io.BytesIO(xml_payload.encode('utf-8'))\n    device_tree = etree.parse(config_stream, parser)\n    root = device_tree.getroot()\n    device_id = root.find('.//DeviceID').text\n    firmware_url = root.find('.//FirmwareURL').text\n    telemetry_interval = root.find('.//TelemetryInterval').text\n    return {'device_id': device_id, 'firmware_url': firmware_url, 'interval': telemetry_interval}"}