Unsanitized user input in XML External Entity

• Rule ID: go_lang_xml_external_entity_vulnerability
• Languages: go
• Source: xml_external_entity_vulnerability.yml

Description

Unsanitized user input in XML External Entity (XXE) processing can lead to security vulnerabilities. This issue arises when XML input containing a reference to an external entity is processed without proper sanitization, potentially allowing attackers to access or interact with external systems.

Remediations

• Do not parse XML input containing external entities from untrusted sources. Doing so allows potential attackers to exploit XXE vulnerabilities and gain access to unauthorized data or systems.

References

• OWASP XML External Entity (XXE) prevention cheat sheet

Associated CWE

• CWE-611: Improper Restriction of XML External Entity Reference

OWASP Top 10

• A05:2021 - Security Misconfiguration

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=go_lang_xml_external_entity_vulnerability

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=go_lang_xml_external_entity_vulnerability