XML Entity Expansion (XML Bomb)

// parser/XmlProcessor.java
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import org.w3c.dom.Document;
import org.xml.sax.InputSource;
import java.io.StringReader;

public Document parseXml(String xmlData) throws Exception {
    // DANGEROUS: Default settings might allow DTD processing and
    // unbounded internal entity expansion ("Billion Laughs").
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    DocumentBuilder builder = factory.newDocumentBuilder();
    // Parsing the Billion Laughs payload here could consume huge memory/CPU.
    return builder.parse(new InputSource(new StringReader(xmlData)));
}

// parser/StaxProcessor.java
import javax.xml.stream.XMLInputFactory;
import javax.xml.stream.XMLStreamReader;
import java.io.StringReader;

public void processXmlStax(String xmlData) throws Exception {
    // DANGEROUS: Defaults might allow entity expansion.
    XMLInputFactory factory = XMLInputFactory.newInstance();
    XMLStreamReader reader = factory.createXMLStreamReader(new StringReader(xmlData));
    // Iterating through events might hang or crash on Billion Laughs payload.
    while(reader.hasNext()){ reader.next(); }
}

// parser/XmlProcessor.java (Secure DOM Parser)
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.XMLConstants; // For FEATURE_SECURE_PROCESSING

public Document parseXmlSecure(String xmlData) throws Exception {
    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();

    // SECURE: Disable DTDs entirely (Prevents XXE and Entity Bombs via DTD).
    factory.setFeature("[http://apache.org/xml/features/disallow-doctype-decl](http://apache.org/xml/features/disallow-doctype-decl)", true);

    // SECURE: Disable external entities (Defense-in-depth for XXE)
    factory.setFeature("[http://xml.org/sax/features/external-general-entities](http://xml.org/sax/features/external-general-entities)", false);
    factory.setFeature("[http://xml.org/sax/features/external-parameter-entities](http://xml.org/sax/features/external-parameter-entities)", false);

    // SECURE: Prevent entity expansion (Defense-in-depth for XML Bombs).
    // Note: Disabling DTDs often makes this redundant, but explicit is good.
    factory.setExpandEntityReferences(false);

    // Optional: Use FEATURE_SECURE_PROCESSING (often recommended)
    factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

    // ... configure other features, create builder, set error handler ...
    DocumentBuilder builder = factory.newDocumentBuilder();
    builder.setErrorHandler(new SimpleErrorHandler()); // Prevent errors going to stderr
    return builder.parse(new InputSource(new StringReader(xmlData)));
}

// parser/StaxProcessor.java (Secure StAX Parser)
import javax.xml.stream.XMLInputFactory;

public void processXmlStaxSecure(String xmlData) throws Exception {
    XMLInputFactory factory = XMLInputFactory.newInstance();

    // SECURE: Disable DTDs entirely.
    factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
    // SECURE: Disable external entity support (defense-in-depth for XXE).
    factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
    // SECURE: Prevent internal entity expansion (for XML bombs).
    factory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, false);

    XMLStreamReader reader = factory.createXMLStreamReader(new StringReader(xmlData));
    while(reader.hasNext()){ reader.next(); } // Should now parse safely or error quickly
}

// parser/XmlParser.cs
using System.Xml;

public XmlDocument LoadXmlUnsafe(string xmlData)
{
    var xmlDoc = new XmlDocument();
    // DANGEROUS: In older .NET, XmlResolver might be enabled by default.
    // Explicitly allowing DTD parsing also enables entity expansion bombs.
    var settings = new XmlReaderSettings { DtdProcessing = DtdProcessing.Parse }; // DANGEROUS
    // Need to create reader with settings and load via reader
    using(var reader = XmlReader.Create(new StringReader(xmlData), settings)) {
       xmlDoc.Load(reader); // Vulnerable loading
    }
    // Or directly (if defaults were unsafe):
    // xmlDoc.LoadXml(xmlData);
    return xmlDoc;
}

// parser/XmlReaderParser.cs
using System.Xml;
using System.IO;

public void ProcessXmlReaderUnsafeLimits(string xmlData)
{
    var settings = new XmlReaderSettings();
    settings.DtdProcessing = DtdProcessing.Ignore; // DTDs ignored, but entities might still expand
    // DANGEROUS: Setting an extremely high limit for entity expansion size.
    settings.MaxCharactersFromEntities = 0; // 0 might mean unlimited in some contexts, or use long.MaxValue

    using (var reader = XmlReader.Create(new StringReader(xmlData), settings))
    {
        // Parsing might still consume huge resources if internal entities expand massively.
        while (reader.Read()) { /* ... */ }
    }
}

// parser/XmlParser.cs (Secure XmlDocument/XmlReader)
using System.Xml;
using System.IO;

public XmlDocument LoadXmlSecure(string xmlData)
{
    var xmlDoc = new XmlDocument();
    // SECURE: Explicitly set resolver to null (often default).
    xmlDoc.XmlResolver = null;
    try {
         // LoadXml generally doesn't process DTDs if XmlResolver is null.
         xmlDoc.LoadXml(xmlData);
         return xmlDoc;
    } catch (XmlException ex) { /* Handle: Should error safely on DTDs */ return null;}
}

public void ProcessXmlReaderSecure(string xmlData)
{
    var settings = new XmlReaderSettings();
    // SECURE: Explicitly prohibit DTD processing (default in modern .NET).
    settings.DtdProcessing = DtdProcessing.Prohibit;
    // SECURE: Ensure resolver is null (default when DTDs prohibited).
    settings.XmlResolver = null;
    // SECURE: Keep default entity size limits.

    try {
        using (var reader = XmlReader.Create(new StringReader(xmlData), settings))
        {
             while (reader.Read()) { /* process */ }
        }
    } catch (XmlException ex) { /* Handle: Should error safely */ }
}

// Secure XDocument (Defaults are generally safe)
using System.Xml.Linq;
public void ProcessXDocumentSecure(string xmlData)
{
     try {
          // SECURE: XDocument.Parse defaults prohibit DTDs.
          XDocument doc = XDocument.Parse(xmlData, LoadOptions.None);
     } catch (XmlException ex) { /* Handle */ }
}

<?php
// Assume PHP < 8.0 or explicit override enabling entities
$xmlData = file_get_contents('php://input'); // Read POST data

// DANGEROUS: Default simplexml_load_string might expand internal entities from DTD.
$xml = simplexml_load_string($xmlData); // Billion Laughs payload crashes this

if ($xml === false) { echo "Failed loading XML"; }
else { echo "Processing"; }
?>

<?php
$xmlData = file_get_contents('php://input');
$dom = new DOMDocument();

// DANGEROUS: Default loadXML might expand internal entities.
$dom->loadXML($xmlData); // Billion Laughs payload crashes this

echo "Processing";
?>

<?php
// Secure SimpleXML
$xmlData = file_get_contents('php://input');

// SECURE: Disable entity loader before parsing.
$previous_loader_state = libxml_disable_entity_loader(true);

// Parse the XML safely. LIBXML_NONET prevents network access too.
$xml = simplexml_load_string($xmlData, "SimpleXMLElement", LIBXML_NONET);

// SECURE: Restore previous loader state if necessary.
libxml_disable_entity_loader($previous_loader_state);

if ($xml === false) {
    echo "Failed loading XML\n";
    // Log libxml_get_errors()
} else {
    echo "Processing Complete\n";
}

// Secure DOMDocument
$dom = new DOMDocument();

$previous_loader_state = libxml_disable_entity_loader(true);
// Use LIBXML_NONET for defense in depth
$loaded = $dom->loadXML($xmlData, LIBXML_NONET);
libxml_disable_entity_loader($previous_loader_state);

if ($loaded) {
    echo "DOM Processing Complete\n";
} else {
    echo "Failed loading DOM XML\n";
     // Log libxml_get_errors()
}
?>

// parser/libxmljs_parser.js
const libxmljs = require("libxmljs");

function parseXmlLibXml(xmlData) {
  try {
    // DANGEROUS: Defaults might allow DTD loading and entity expansion.
    const xmlDoc = libxmljs.parseXml(xmlData); // Vulnerable to Billion Laughs
    // ... process doc ...
  } catch (e) { /* ... */ }
}

// parser/xmldom_parser.js
const { DOMParser } = require('xmldom');

function parseXmlDom(xmlData) {
    try {
        const parser = new DOMParser();
        // DANGEROUS: Default parsing might expand entities.
        const doc = parser.parseFromString(xmlData, 'application/xml');
        // Processing 'doc' could trigger expansion DoS.
        // ... process doc ...
    } catch (e) { /* ... */ }
}

// parser/libxmljs_parser.js (Secure)
const libxmljs = require("libxmljs");

function parseXmlLibXmlSecure(xmlData) {
  try {
    // SECURE: Explicitly disable DTD loading and entity substitution.
    const options = {
        // dtdload: false, // Do not load external DTDs
        doctype: false, // Do not process DOCTYPE declaration
        noent: false,   // Do not substitute entities
        nonet: true,    // Disable network access
        // Add other safety options as per libxmljs docs
    };
    const xmlDoc = libxmljs.parseXml(xmlData, options);
    // ... process doc ...
  } catch (e) {
    // Should catch errors related to DTDs/Entities being disallowed
    console.error("libxmljs parse error:", e);
  }
}

// parser/xmldom_parser.js (Secure - Requires checking options)
const { DOMParser } = require('xmldom');

function parseXmlDomSecure(xmlData) {
    try {
        // SECURE: Check xmldom documentation for options to disable DTDs/entities.
        // It might involve providing custom handlers or flags.
        // Example: Using error handler to detect/stop DTD processing.
        let containsDoctype = false;
        const parser = new DOMParser({
            locator: {},
            errorHandler: {
                warning: (w) => { /* Ignore */ },
                error: (e) => { throw e; },
                fatalError: (e) => { throw e; }
            },
            // Need to investigate specific options for entity control if they exist.
            // The primary defense is often preventing DTD processing itself.
        });
         // Pre-check for DOCTYPE might be necessary if no direct flag exists
        if (xmlData.toUpperCase().includes("<!DOCTYPE")) {
             throw new Error("DOCTYPE is forbidden.");
        }
        const doc = parser.parseFromString(xmlData, 'application/xml');
        // ... process doc ...
    } catch (e) {
        console.error("xmldom parse error:", e); // Should catch DOCTYPE error
    }
}

# parser/rexml_parser.rb
require 'rexml/document'

def parse_rexml(xml_data)
  begin
    # DANGEROUS: Older Ruby/REXML might allow entity expansion by default.
    doc = REXML::Document.new(xml_data) # Billion Laughs payload crashes this
    # ... process doc ...
  rescue REXML::ParseException => e
    # ... handle error ...
  end
end

# parser/nokogiri_parser.rb
require 'nokogiri'

def parse_nokogiri_unsafe(xml_data)
  begin
    # DANGEROUS: Explicitly enabling DTD loading, although Nokogiri
    # has some internal limits, this increases risk surface.
    doc = Nokogiri::XML(xml_data) do |config|
      config.strict.dtdload # Enable DTD loading
    end
    # ... process doc ...
  rescue Nokogiri::XML::SyntaxError => e
    # ...
  end
end

# parser/rexml_parser.rb (Secure)
require 'rexml/document'

def parse_rexml_secure(xml_data)
  begin
    # SECURE: Explicitly disable entity expansion.
    doc = REXML::Document.new(xml_data, { entity_expansion_limit: 0 })
    # ... process doc ...
  rescue REXML::ParseException => e
    # Should error safely if DTD entities are present
    puts "REXML Parse Error: #{e.message}"
  rescue => e # Catch potential resource limit errors too
    puts "Error: #{e.message}"
  end
end

# parser/nokogiri_parser.rb (Secure)
require 'nokogiri'

def parse_nokogiri_secure(xml_data)
  begin
    # SECURE: Use default Nokogiri parser options (no DTD loading).
    doc = Nokogiri::XML(xml_data)
    # Or be explicit with safe options:
    # doc = Nokogiri::XML(xml_data) { |config| config.strict.nonet } # NONET prevents network access
    # ... process doc ...
  rescue Nokogiri::XML::SyntaxError => e
    # Nokogiri often raises errors like "Entity expansion detected"
    puts "Nokogiri Parse Error: #{e.message}"
  end
end