{"title":"XML External Entity (XXE) via unsafe XML parser configuration","language":"Python","severity":"High","cwe":"CWE-611","source_lines":[5],"flow_lines":[5,8],"sink_lines":[8],"vulnerable_code":"import lxml.etree as etree\nfrom flask import request, jsonify\n\ndef process_iot_device_telemetry():\n    device_xml = request.data\n    parser = etree.XMLParser(resolve_entities=True, no_network=False)\n    try:\n        telemetry_doc = etree.fromstring(device_xml, parser)\n        device_id = telemetry_doc.find('.//deviceId').text\n        temperature = telemetry_doc.find('.//temperature').text\n        humidity = telemetry_doc.find('.//humidity').text\n        return jsonify({'status': 'success', 'device': device_id, 'temp': temperature, 'humidity': humidity})\n    except Exception as e:\n        return jsonify({'error': 'Telemetry parsing failed', 'details': str(e)}), 400","explanation":"The code accepts untrusted XML data from the HTTP request body and parses it using lxml with resolve_entities=True and no_network=False, enabling XXE attacks. An attacker can inject malicious XML with external entity declarations to read local files, perform SSRF attacks, or cause denial of service.","remediation":"The fix disables XML external entity resolution by setting resolve_entities=False and no_network=True, preventing the parser from loading external entities or making network requests. Additionally, dtd_validation=False and load_dtd=False are set to prevent DTD-based attacks entirely.","secure_code":"import lxml.etree as etree\nfrom flask import request, jsonify\n\ndef process_iot_device_telemetry():\n    device_xml = request.data\n    parser = etree.XMLParser(resolve_entities=False, no_network=True, dtd_validation=False, load_dtd=False)\n    try:\n        telemetry_doc = etree.fromstring(device_xml, parser)\n        device_id = telemetry_doc.find('.//deviceId').text\n        temperature = telemetry_doc.find('.//temperature').text\n        humidity = telemetry_doc.find('.//humidity').text\n        return jsonify({'status': 'success', 'device': device_id, 'temp': temperature, 'humidity': humidity})\n    except Exception as e:\n        return jsonify({'error': 'Telemetry parsing failed', 'details': str(e)}), 400"}