XML interview question · Most asked
What is an XXE attack and how do you prevent it?
Summary
XML External Entity injection: a document declares an entity pointing to a file or URL (<!ENTITY x SYSTEM "file:///etc/passwd">), and a parser that resolves external entities includes the content, disclosing files or making server-side requests (SSRF). Prevent it by disabling DTDs/external entities: Java disallow-doctype-decl, lxml resolve_entities=False, no_network=True, Python defusedxml, PHP no LIBXML_NOENT, .NET DtdProcessing.Prohibit.
Longer Answer
Centralise parser creation, don't echo parsed input in errors, and restrict outbound network access from services that parse XML. XXE was in the OWASP Top 10 (2017) and still appears in SOAP, SAML and file uploads (DOCX, SVG).
Key Points
- External entity reads files/URLs.
- File disclosure and SSRF.
- Disable DTDs per language.
- Central factory, egress limits.
Deep dive: XML Tutorial: XML Security: XXE and Entity Attacks
Explanation
What interviewers look for
Correct per-language settings, not just 'validate input'.
More most-asked XML questions
- Explain XML namespaces and the default namespace.
- Your XPath query returns nothing, but the elements are clearly there. What's the likely cause?
- Compare DOM, SAX and StAX (or pull parsing).
- What's the difference between well-formed and valid XML?
- How does XSLT work? Explain templates and apply-templates.
- How would you process a 10 GB XML file?
- What is XML and where is it still used today?
- Which characters must be escaped in XML, and what is CDATA?