---
title: "Turn off external entities in XML · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/input-and-injection/xml-entities
id: APS-7
level: Required
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 814
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Turn off external entities in XML

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Input and injection](https://agentwranglers.se/playbook/application-security/input-and-injection.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-7
- Level: Required
- Chapter: [Input and injection](https://agentwranglers.se/playbook/application-security/input-and-injection.md)
- Rule: When the app parses XML, turn off external entities and document types in the parser, or accept JSON instead.
- Check: Upload an XML or SVG file that defines an entity pointing at `file:///etc/hostname`. The reply never contains the server's host name, and the request is refused or the entity stays empty.
- Risk: Data leaked or lost
- How: Skip this rule when nothing in the app parses XML. Set the parser options that disable DTDs and external entities, or use a hardened parser. Many parsers still allow them by default. Turning off DTDs also stops entity bombs that expand to gigabytes. Remember that SVG images, office files and SAML messages are XML too. [Fuzz every parser of untrusted input](https://agentwranglers.se/playbook/testing/security-and-robustness/fuzz-parsers.md) to find the cases a single test misses.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### XML example

```xml
<?xml version="1.0"?>
<!DOCTYPE t [<!ENTITY aw SYSTEM "file:///etc/hostname">]>
<t>&aw;</t>
```

### Python example

```python
# Python: defusedxml refuses entities and DTD tricks
import defusedxml.ElementTree as ET
tree = ET.fromstring(body)
```

### Java example

```java
// Java: refuse any document type declaration
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setXIncludeAware(false);
factory.setExpandEntityReferences(false);
```

## Sources

- [OWASP XML External Entity Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)

## Related rules

- TST-39 [Fuzz every parser of untrusted input](https://agentwranglers.se/playbook/testing/security-and-robustness/fuzz-parsers.md) in Testing

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/input-and-injection/xml-entities">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Strip line breaks from headers and logs](https://agentwranglers.se/playbook/application-security/input-and-injection/header-injection.md)
- Next: [Never rebuild objects from untrusted data](https://agentwranglers.se/playbook/application-security/input-and-injection/unsafe-deserialisation.md)
- [Input and injection](https://agentwranglers.se/playbook/application-security/input-and-injection.md)