XML 外部實體注入 (XXE)
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
OWASP 類別：MASVS-CODE：程式碼品質
總覽
XML eXternal Entity 注入 (XXE) 是針對剖析 XML 輸入內容的應用程式發動的攻擊。當含有外部實體參照項目的不受信任 XML 輸入內容，遭到設定不嚴格的 XML 剖析器處理時，就會發生 XXE 攻擊。這類攻擊可用於發動多項事件，包括拒絕服務、檔案系統存取或資料外洩。
影響
應用程式剖析 XML 文件時，可以處理文件中包含的任何 DTD (文件類型定義，也稱為外部實體)。攻擊者可以藉由插入惡意程式碼作為 DTD 來利用此行為。這段程式碼接著可存取裝置的部分檔案系統，該系統僅供應用程式存取，且可能含有私密資料。此外，這段惡意程式碼可能會從裝置發出要求，繞過邊界安全措施。
最後，如果應用程式擴充 DTD，可能會導致引用實體的多次疊代，耗盡裝置的資源，並導致服務遭到拒絕。
因應措施
停用 DTD
如要防範 XXE，最安全的方法就是一律完全停用 DTD (外部實體)。視使用的剖析器而定，方法可能類似下列 XML Pull Parser 程式庫的範例：
Java
XmlPullParserFactory factory = XmlPullParserFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
Kotlin
val factory = XmlPullParserFactory.newInstance()
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
停用 DTD 也會讓剖析器免於遭受阻斷服務攻擊。如果無法完全停用 DTD，就必須以每個剖析器特有的方式停用外部實體和外部文件類型宣告。
由於市面上有許多 XML 剖析引擎，防範 XXE 攻擊的方式會因引擎而異。詳情請參閱引擎說明文件。
應用程式應重新設定，以免使用者在 XML 文件的前置程式中插入任意程式碼。由於用戶端控件可被略過，因此必須在伺服器端進行驗證。
使用其他程式庫
如果無法以安全的方式設定所用程式庫或方法，建議您考慮使用其他程式庫或方法。XML 提取剖析器和 SAX 剖析器都可以以安全的方式進行設定，禁止使用 DTD 和實體。
資源
這個頁面中的內容和程式碼範例均受《內容授權》中的授權所規範。Java 與 OpenJDK 是 Oracle 和/或其關係企業的商標或註冊商標。
上次更新時間：2025-07-26 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-26 (世界標準時間)。"],[],[],null,["# XML External Entities Injections (XXE)\n\n\u003cbr /\u003e\n\n**OWASP category:** [MASVS-CODE: Code Quality](https://mas.owasp.org/MASVS/10-MASVS-CODE)\n\nOverview\n--------\n\nAn XML eXternal Entity injection (XXE) is an attack against applications that\nparse XML input. An XXE attack occurs when untrusted XML input with a reference\nto an external entity is processed by a weakly configured XML parser. This\nattack can be used to stage multiple incidents, including denial of service,\nfile system access, or data exfiltration.\n\nImpact\n------\n\nWhen an application parses an XML document, it can process any DTDs (Document\nType Definitions, also known as external entities) contained within the\ndocument. An attacker can exploit this behavior by injecting malicious code as\nDTDs. This code can then access parts of the file system of the device, only\naccessible to the application and potentially containing sensitive data.\nFurthermore, this malicious code can make requests from the device, potentially\nbypassing perimeter security measures.\n\nLastly, if the application expands DTDs,\nthis can create a situation with multiple iterations of referenced entities,\nexhausting the resources of the device and leading to a denial of service.\n\nMitigations\n-----------\n\n### Disable DTDs\n\nThe safest way to prevent XXE is to always disable DTDs (external entities)\ncompletely. Depending on the parser in use, the method could be similar to the\nfollowing example for the XML Pull Parser library: \n\n### Java\n\n XmlPullParserFactory factory = XmlPullParserFactory.newInstance();\n factory.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n\n### Kotlin\n\n val factory = XmlPullParserFactory.newInstance()\n factory.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true)\n\nDisabling DTDs also makes the parser secure against denial of service attacks.\nIf it is not possible to disable DTDs completely, then external entities and\nexternal document type declarations must be disabled in a way that's specific to\neach parser.\n\nBecause of the large number of XML parsing engines in the market, the ways to\nprevent XXE attacks differ from engine to engine. You may need to refer to your\nengine documentation for more information.\n\n### Perform input sanitisation\n\nThe application should be reconfigured so that it does not allow users to inject\narbitrary code in the XML document's preamble. This has to be verified\nserver-side, as client-side controls can be bypassed.\n\n### Use a different library\n\nIf the library or method used cannot be configured in a secure manner, a\ndifferent one should be considered. [XML Pull Parser](/reference/org/xmlpull/v1/XmlPullParser) and [SAX Parser](/reference/javax/xml/parsers/SAXParser) can\nboth be configured in a secure manner, disallowing DTDs and entities.\n\nResources\n---------\n\n- [OWASP XXE](https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing)\n- [OWASP XXE Prevention Cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)\n- [XML Constants: FEATURE_SECURE_PROCESSING](/reference/javax/xml/XMLConstants#FEATURE_SECURE_PROCESSING)\n- [XML Pull Parser](/reference/org/xmlpull/v1/XmlPullParser)\n- [SAX Parser](/reference/javax/xml/parsers/SAXParser)"]]
