The Complete Production SOP: How to Deploy and Run XML External Entity (XXE) Attack Prevention in Autonomous AI Agents
Harden AI coding agents against XML External Entity (XXE) vulnerabilities. Install and run the XXE prevention skill in Codex, Claude Code, Cursor, and Windsurf.
Technical Overview & Architectural Context
Autonomous coding agents frequently generate vulnerable XML parsing logic because standard language libraries across Python, Java, Node.js, and PHP enable Document Type Definition (DTD) processing and external entity resolution by default. When an agent is prompted to parse XML files, it routinely suggests naive APIs like standard Python `xml.etree.ElementTree`, default Java `DocumentBuilderFactory`, or unconfigured `libxmljs` instances, directly introducing high-severity OWASP Top 10 vulnerabilities (CWE-611). Without explicit, deterministic boundaries, agents fail to anticipate blind SSRF, local file disclosure (e.g., `/etc/passwd`), or entity expansion denial-of-service (Billion Laughs) attacks. The `xml-external-entity-xxe-prevention` skill injects mandatory architectural constraints into the agent's context, compelling it to enforce safe defaults—such as substituting native Python XML parsers with `defusedxml` and applying explicit feature flags in Java and Node.js. By mounting this skill across your agent runtime (Codex, Claude Code, Cursor, or Windsurf), the agent is constrained by a deterministic verification SOP. It guarantees that any code written or refactored to handle XML payloads explicitly disallows external DTDs, disables general entities, and passes automated security linters before completing the task.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules into the agent runtime path.
Autonomous coding agents locate skills by inspecting `.agents/skills` or `.claude/skills` directories within the project root or user configuration path. Downloading and mounting the `xml-external-entity-xxe-prevention` skill provides the agent with deterministic runtime instructions, parameter boundaries, and triggers that activate whenever XML parsing or security refactoring is requested.
mkdir -p .agents/skills/xml-external-entity-xxe-prevention && curl -fsSL https://askills.dev/api/skills/xml-external-entity-xxe-prevention/raw -o .agents/skills/xml-external-entity-xxe-prevention/SKILL.md---
name: "xml-external-entity-xxe-prevention"
description: "Disable DTD external entity resolution to eliminate XML External Entity attacks."
metadata:
author: "OWASP"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "prevent xxe attack"
- "configure safe xml parser"
- "disable dtd processing xml"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---
# XML External Entity (XXE) Attack Prevention
Hardens XML parsers across Python (defusedxml), Node.js, Java, and PHP: disabling external entity resolution, external DTD loading, and XML entity expansion (Billion Laughs denial of service).
## Execution SOP & Rules
1. Disable DTD processing and external entity resolution in all XML parser configurations.
2. In Python, use defusedxml.minidom or defusedxml.ElementTree instead of standard library modules.
3. In Java, set factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true).
4. In Node.js (libxmljs), always pass { noent: false, noblanks: true } and never enable dtdload/dtdvalid.
5. Prefer JSON over XML for data interchange formats whenever feasible.
## Verification Checklist
- Run local AST/SAST scanning (Bandit, Semgrep) to confirm no unhardened parser constructors exist.
- Verify parser unit tests reject DTD payloads and SYSTEM declarations with safe exceptions.Keep the SKILL.md scoped strictly to parser configuration rules. Minimizing markdown size preserves agent context windows and reduces inference token costs across multi-turn sessions.
Ensure directory permissions match your IDE runtime. In Windsurf and Cursor workspaces, putting skills in user-level global directories without read permissions will prevent the agent from parsing triggers.
Environment Secrets & Dependency Validation
Verify required hardening dependencies like defusedxml or secure parsing wrappers exist in the project manifest.
XXE remediation often requires specialized, secure-by-default libraries such as Python's `defusedxml` or Java's OWASP ESAPI wrappers. Ensure that the agent verifies the presence of these libraries in `requirements.txt`, `pyproject.toml`, or `package.json` before attempting code generation, preventing failed build pipelines.
python3 -c "import defusedxml" 2>/dev/null || pip install defusedxml; which semgrep || pip install semgrepDirect the agent to inspect locked dependency trees rather than blind-installing packages to avoid supply-chain risks.
Do not commit sandbox credentials or private package registry tokens into the workspace context during agent dependency checks.
Intent Matching & Trigger Invocation
Activate deterministic security routines using exact operational triggers from the frontmatter.
Trigger the skill deterministically by invoking recognized phrases such as 'prevent xxe attack' or 'configure safe xml parser'. This forces the agent's planner to bind its file modification subroutines directly to the SOP rules defined in the SKILL.md file, bypassing its standard non-secure XML generation path.
Use imperative, domain-specific trigger phrases such as 'configure safe xml parser with defusedxml' to eliminate ambiguity.
Generic prompts like 'parse this xml payload' may trigger general coding heuristics rather than the hardened XXE prevention SOP.
Verification, Linting & Output Quality Gate
Enforce static analysis and unit testing before accepting agent file edits into git staging.
Autonomous agents must self-validate that the newly hardened parsers successfully block entity expansion and external resource loading. Run Semgrep or Bandit to ensure no standard library XML parsers remain unshielded in the workspace.
semgrep --config "p/r2c-security-audit" --error --lang python src/Configure the agent to automatically inspect `git diff` against XXE CWE-611 patterns before presenting its final review.
Be mindful of legacy tests that supply mock DTD entities; hardening the parser will intentionally fail tests that depend on entity resolution.
Real-World Scenario: Remediating High-Severity XXE in a Python FastAPI SAML Metadata Consumer
“Review our SAML metadata ingestion endpoint at src/auth/metadata.py. It uses xml.etree.ElementTree.parse(). Follow our skill SOP to configure safe xml parser and prevent xxe attack vulnerabilities.”
Runtime Troubleshooting & Failure Modes
Root Cause: The secure parser successfully intercepted an attempted XML entity expansion or external entity inclusion, throwing an intentional security exception that was unhandled by application logic.
try:
root = defusedxml.ElementTree.fromstring(xml_payload)
except (defusedxml.common.DefusedXmlException, xml.etree.ElementTree.ParseError) as exc:
logger.warning("Malicious or malformed XML rejected: %s", exc)
raise HTTPException(status_code=400, detail="Invalid XML structure")Root Cause: The underlying Java XML parser implementation does not support the xerces disallow-doctype-decl feature flag (common with certain JAXP runtime vendors).
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
// Fallback configuration for JAXP parsers:
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);Frequently Asked Questions (XML External Entity (XXE) Attack Prevention SOP)
Q:Can I use XML External Entity (XXE) Attack Prevention across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification supported across all modern agent runtimes. By placing the file in the shared `.agents/skills` path, any compatible engine (Codex Desktop, Claude Code CLI, Cursor, or Windsurf) will parse and apply the XXE prevention SOP automatically.
Q:How does XML External Entity (XXE) Attack Prevention prevent context window overflow during long agent sessions?
The skill provides concise, declarative parser directives and deterministic verification rules. Instead of requiring the LLM to process exhaustive AppSec documentation or repetitive prompt re-injections across multi-turn chats, the skill delivers compact SOP guidelines that minimize token usage.
Q:Does this skill require escalated root or container permissions?
No. The skill is audited with a security score of 98/100 and operates strictly within workspace boundaries (fs_read: true, fs_write: workspace). It forbids shell execution and network access by default, safely confining remediation activities to application code within your project repository.
Ready to equip your autonomous agent with XML External Entity (XXE) Attack Prevention?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.