xxe_prescan report — 7 file(s), 25 finding(s)

HIGH   XXE-DEFAULT-PARSER cs/Xml.cs:6  XmlTextReader resolves external entities by default — use XmlReader.Create with DtdProcessing.Prohibit
       | var r = new XmlTextReader(s);
HIGH   XXE-EXT-OPT        cs/Xml.cs:10  explicit entity/DTD-enabling option — external entities resolvable (file read / SSRF / DoS)
       | s.DtdProcessing = DtdProcessing.Parse;
HIGH   XXE-EXT-OPT        cs/Xml.cs:13  explicit entity/DTD-enabling option — external entities resolvable (file read / SSRF / DoS)
       | d.XmlResolver = new XmlUrlResolver();
HIGH   XXE-DEFAULT-PARSER java/XmlService.java:10  XML parser/factory resolves external entities by default — needs disallow-doctype-decl / external-entity feature-off
       | DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
HIGH   XXE-DEFAULT-PARSER java/XmlService.java:14  XML parser/factory resolves external entities by default — needs disallow-doctype-decl / external-entity feature-off
       | SAXParserFactory sf = SAXParserFactory.newInstance();
HIGH   XXE-DEFAULT-PARSER java/XmlService.java:18  XML parser/factory resolves external entities by default — needs disallow-doctype-decl / external-entity feature-off
       | XMLInputFactory xif = XMLInputFactory.newInstance();
HIGH   XXE-DEFAULT-PARSER java/XmlService.java:22  XML parser/factory resolves external entities by default — needs disallow-doctype-decl / external-entity feature-off
       | Document doc = DocumentHelper.parseText(body);
HIGH   XXE-EXT-OPT        java/XmlService.java:30  explicit entity/DTD-enabling option — external entities resolvable (file read / SSRF / DoS)
       | f.setExpandEntityReferences(true);
HIGH   XXE-EXT-OPT        java/XmlService.java:33  explicit entity/DTD-enabling option — external entities resolvable (file read / SSRF / DoS)
       | p.setFeature("http://xml.org/sax/features/external-general-entities", true);
HIGH   XXE-EXT-OPT        js/xml.js:3  libxmljs noent:true — substitutes external entities
       | const doc = libxmljs.parseXml(body, {noent: true});
HIGH   XXE-EXT-OPT        php/xml.php:4  explicit entity/DTD-enabling option — external entities resolvable (file read / SSRF / DoS)
       | return simplexml_load_string($body, 'SimpleXMLElement', LIBXML_NOENT);
HIGH   XXE-EXT-OPT        php/xml.php:7  explicit entity/DTD-enabling option — external entities resolvable (file read / SSRF / DoS)
       | libxml_disable_entity_loader(false);
HIGH   XXE-DEFAULT-PARSER py/xmlparse.py:8  xml.sax resolves external entities by default — needs feature_external_ges/pes disabled or defusedxml
       | xml.sax.parseString(body, Handler())
HIGH   XXE-DEFAULT-PARSER py/xmlparse.py:12  xml.sax resolves external entities by default — needs feature_external_ges/pes disabled or defusedxml
       | return xml.sax.make_parser()
HIGH   XXE-EXT-OPT        rb/xml.rb:2  explicit entity/DTD-enabling option — external entities resolvable (file read / SSRF / DoS)
       | doc = Nokogiri::XML(body, nil, nil, Nokogiri::XML::ParseOptions::NOENT)
MEDIUM XXE-EXT-ACCESS     java/XmlService.java:25  transformer/schema/xpath factory — external DTD/stylesheet/schema fetch unless ACCESS_EXTERNAL_* is locked down
       | TransformerFactory tf = TransformerFactory.newInstance();
MEDIUM XXE-DTD-ENABLED    py/xmlparse.py:17  minidom/pulldom parse — internal entity expansion; external entities not fetched
       | return minidom.parseString(body)
MEDIUM XXE-DTD-ENABLED    py/xmlparse.py:21  stdlib etree parse — internal entity expansion (billion laughs on old runtimes); external entities not fetched
       | return ET.parse(path)
MEDIUM XXE-DTD-ENABLED    rb/xml.rb:4  REXML/Nokogiri parse — internal entity expansion; external fetch needs NOENT (flagged separately)
       | doc2 = REXML::Document.new(body)
MEDIUM XXE-DTD-ENABLED    rb/xml.rb:5  REXML/Nokogiri parse — internal entity expansion; external fetch needs NOENT (flagged separately)
       | doc3 = Nokogiri::XML(body)
LOW    XXE-DTD-ENABLED    cs/Xml.cs:17  XmlDocument/XmlReader parse — safe default only on .NET >= 4.5.2; older frameworks resolve external entities
       | var d = new XmlDocument();
LOW    XXE-DTD-ENABLED    cs/Xml.cs:18  XmlDocument/XmlReader parse — safe default only on .NET >= 4.5.2; older frameworks resolve external entities
       | d.Load(s);
LOW    XXE-DEFAULT-PARSER java/XmlService.java:37  XML parser/factory resolves external entities by default — needs disallow-doctype-decl / external-entity feature-off
       | DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
LOW    XXE-DTD-ENABLED    php/xml.php:11  libxml parse — internal entity expansion; external entities only with LIBXML_NOENT (flagged separately)
       | $d->loadXML($body);
LOW    XXE-DTD-ENABLED    php/xml.php:17  libxml parse — internal entity expansion; external entities only with LIBXML_NOENT (flagged separately)
       | $model->load($data);

scope: deterministic pre-scan — flags parser constructions/options for review; not an audit, clean != XXE-safe