XML
Safe XML Handling in PHP and Node for Untrusted Input
Parse untrusted XML in PHP 8.5 and Node 24: why LIBXML_NOENT is the dangerous flag, what DOMDocument does, and how two Node parsers behave.
6 min read
Tag
security
43 posts
XML
Disabling DTDs and External Entities in Java and Python
Parser settings that stop XXE in Java and Python, tested on one file: which Java features block it, what each error says, and the lxml options.
7 min read
XML
Stopping the Billion Laughs Attack in Your XML Parser
A 547-byte file that expands to 30 million characters. How lxml, ElementTree and Java refused it, what the limits are, and the settings that keep them on.
6 min read
XML
What an XML External Entity Attack Is and Where It Works
An XXE attack makes a parser read a file or fetch a URL the sender names. Run on five parsers, three leaked a local file by default or with one flag.
7 min read
XMLGuide
XML Security Problems to Close Before Production Launch
The XML attacks that matter for web services and loaders, how six parsers behave, one parse function with limits, and the tests that keep it closed.
18 min read
YAML
Keeping Secrets Out of YAML Config Files and Git History
A password removed from a YAML file stayed in Git history. Reference secrets by name, scan the tree and the history, and rotate anything that was committed.
6 min read
YAML
Why yaml load Is Dangerous and What to Use Instead
How a YAML tag makes PyYAML run code during load, a harmless demonstration, what changed in PyYAML 6 and the safe options for loading untrusted files.
6 min read