Zennoxa Shield
Rules / Python
SHIELD-PY-015

XML External Entity (XXE) injection

highPythonCWE-611CVSS 7.5

What it detects

Parsing an in-memory XML string/bytes value with a default parser may allow XXE attacks. Scoped to the fromstring()/XML()/parseString() forms that parse a value the program built (the classic one-line XXE), NOT parse(path_or_fd): parsing a static resource file is not attacker-controlled, and the taint-aware SHIELD-TAINT-XXE sink covers the cases where a user-controlled value reaches any XML parser across lines.

How to fix

Disable external entity processing. Use defusedxml library for safe XML parsing.

Vulnerable — Shield flags thisreports.py
import xml.etree.ElementTree as ET

def parse_report(body: str):
    payload = "<report>" + body + "</report>"
    root = ET.fromstring(payload)
    return root.findtext("title")
Fixed — scans cleanreports.py
from defusedxml.ElementTree import fromstring

def parse_report(body: str):
    payload = "<report>" + body + "</report>"
    root = fromstring(payload)
    return root.findtext("title")

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-015, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-015: XML External Entity (XXE) injection — Zennoxa Shield