---
name: "xml-external-entity-xxe-prevention"
description: "Disable DTD external entity resolution to eliminate XML External Entity attacks."
metadata:
  author: "OWASP"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "prevent xxe attack"
  - "configure safe xml parser"
  - "disable dtd processing xml"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# XML External Entity (XXE) Attack Prevention

Hardens XML parsers across Python (defusedxml), Node.js, Java, and PHP: disabling external entity resolution, external DTD loading, and XML entity expansion (Billion Laughs denial of service).

## When to Invoke
Invoke this skill whenever you need to:
- prevent xxe attack
- configure safe xml parser
- disable dtd processing xml

## Execution SOP & Rules
1. Disable DTD processing and external entity resolution in all XML parser configurations.
2. In Python, use defusedxml.minidom or defusedxml.ElementTree instead of standard library modules.
3. In Java, set factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true).
4. Prefer JSON over XML for data interchange formats whenever feasible.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.