Injection of XML as input, if not blocked by adequate validation mechanisms, can have serious
consequences in terms of security, as we will see in the following example.
Injection of malicious XML in this example, results in an output XML file that would allow the creation
of a user with administrator privileges instead of a normal user.
So the remedy consists in validating the input, for example, with regular expressions and blocking
the possibility of inserting tags enclosed between less than or greater than symbols.
Let's see this other vulnerability. The XML External Entity (XXE) vulnerability. The XXE vulnerability
linked to an exchange of data in XML format, occurs against a poorly configured XML
parser.
A purely configured parser can agree to extract and process data from an external entity instead of
processing the data that should reside in the XML file itself.
The major risk factor for the presence of this vulnerability is that the parser allows the definition
of DTD in the XML document and allows the processing of external resources.
Among the most important remedies, disable XML external entity and DTD processing in all XML
parsers.
As a remedy for XXE, it is also important to use an XML document validation based on XSD,
XML Schema Definition.
Thank you for your kind of attention, take care.