Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-019

XML External Entity (XXE) — entity expansion enabled

highJavaScript / TypeScriptCWE-611CVSS 7.5

What it detects

Parsing XML with noent:true (libxmljs) substitutes external entities, allowing file read / SSRF via a crafted DTD.

How to fix

Parse untrusted XML with noent:false (the default) and without DTD/network loading.

Vulnerable — Shield flags thisxml.js
const libxml = require('libxmljs');

function parseUpload(xmlString) {
  const doc = libxml.parseXml(xmlString, { noent: true, noblanks: true });
  return doc.root().text();
}

module.exports = parseUpload;
Fixed — scans cleanxml.js
const libxml = require('libxmljs');

function parseUpload(xmlString) {
  const doc = libxml.parseXml(xmlString, { noent: false, noblanks: true });
  return doc.root().text();
}

module.exports = parseUpload;

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-019, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-019: XML External Entity (XXE) — entity expansion enabled — Zennoxa Shield