🔵Info0.0

Ruby XXE Prevention

Comprehensive guide to preventing XXE vulnerabilities in Ruby applications using REXML, Nokogiri, and other XML libraries.

CWE-611: Improper Restriction of XML External Entity ReferenceOWASP Top 10:2021 - A05: Security Misconfiguration

Overview

Ruby has multiple XML parsing libraries with different security postures. Understanding each library's defaults and proper configuration is essential for preventing XXE vulnerabilities.

Common Ruby XML Libraries:

Nokogiri - Most popular, uses libxml2 (C library)
REXML - Pure Ruby, built-in to standard library
Ox - Fast XML parser
LibXML-Ruby - Direct libxml2 bindings

Security Status by Default:

Nokogiri 1.5.4+ - SAFE (noent disabled by default)
REXML - VULNERABLE (external entities enabled)
Ox - SAFE (doesn't support external entities)
LibXML-Ruby - VULNERABLE (depends on configuration)

Best Practice: Use Nokogiri with explicit security settings, or REXML with entity expansion disabled.

Nokogiri (Recommended - Safe by Default)

Nokogiri Security: Nokogiri 1.5.4+ is safe by default because it disables the noent option, preventing external entity expansion.

Default Behavior:

External entities are NOT expanded
DTDs are NOT loaded from external sources
Entity references are left as-is in the document

Verify Safe Configuration: Ensure you're not explicitly enabling dangerous options:

DON'T use Nokogiri::XML::ParseOptions::NOENT
DON'T use Nokogiri::XML::ParseOptions::DTDLOAD
DON'T use Nokogiri::XML::ParseOptions::DTDVALID

Safe Default Parse:

require 'nokogiri'

xml = Nokogiri::XML(xml_string)
# Safe: External entities not expanded

Nokogiri Secure Implementation

Rubynokogiri_secure.rb✓ Secure
require 'nokogiri'

# SECURE: Default parsing (safe by default in Nokogiri 1.5.4+)
def parse_xml_secure(xml_string)
  # This is safe - external entities not expanded
  doc = Nokogiri::XML(xml_string)
  doc
end

# SECURE: Explicit safe options
def parse_xml_explicit_safe(xml_string)
  # Explicitly set safe parse options
  doc = Nokogiri::XML(xml_string) do |config|
    # Strict parsing without entity expansion
    config.strict.nonet
  end
  doc
end

# SECURE: Parse with validation but no entities
def parse_xml_with_validation(xml_string)
  doc = Nokogiri::XML(xml_string) do |config|
    config.strict.nonet.noblanks
  end
  
  # Validate against schema if needed
  xsd = Nokogiri::XML::Schema(File.read('schema.xsd'))
  errors = xsd.validate(doc)
  
  raise "Invalid XML: #{errors.join(', ')}" unless errors.empty?
  
  doc
end

# SECURE: Rails/Sinatra controller example
class XMLController < ApplicationController
  def parse
    xml_string = request.body.read
    
    # Validate content type
    unless request.content_type == 'application/xml'
      render json: { error: 'Invalid content type' }, status: 400
      return
    end
    
    # Parse safely
    doc = Nokogiri::XML(xml_string) do |config|
      config.strict.nonet
    end
    
    # Process document...
    render json: { success: true }
  rescue Nokogiri::XML::SyntaxError => e
    render json: { error: 'Invalid XML' }, status: 400
  end
end

Nokogiri Vulnerable Configuration (DON'T DO THIS)

Rubynokogiri_vulnerable.rb⚠️ Vulnerable
require 'nokogiri'

# VULNERABLE: Explicitly enabling dangerous options
def parse_xml_vulnerable(xml_string)
  # DON'T DO THIS! Enables entity expansion
  doc = Nokogiri::XML(xml_string) do |config|
    config.options = Nokogiri::XML::ParseOptions::NOENT |
                     Nokogiri::XML::ParseOptions::DTDLOAD
  end
  doc
end

# VULNERABLE: Using NOENT flag
def parse_with_noent(xml_string)
  # NOENT expands entities - DANGEROUS!
  doc = Nokogiri::XML(xml_string, nil, nil, Nokogiri::XML::ParseOptions::NOENT)
  doc
end

# VULNERABLE: Old Nokogiri versions
# Nokogiri < 1.5.4 is vulnerable by default
# Upgrade to 1.5.4 or later!

# Attack payload that would work with vulnerable configuration:
# <?xml version="1.0"?>
# <!DOCTYPE root [
#   <!ENTITY xxe SYSTEM "file:///etc/passwd">
# ]>
# <root>&xxe;</root>

REXML (Vulnerable by Default)

REXML Security Warning: REXML is Ruby's built-in XML parser but is VULNERABLE to XXE by default. External entities are expanded unless explicitly disabled.

Default Behavior:

External entities ARE expanded
Can read local files
Can make HTTP requests
Vulnerable to billion laughs DoS

If You Must Use REXML:

Set custom entity expansion limit
Disable DOCTYPE declarations if not needed
Validate input before parsing
Consider switching to Nokogiri

Better Alternative: Use Nokogiri instead of REXML for better security defaults and performance.

REXML Secure Implementation

Rubyrexml_secure.rb✓ Secure
require 'rexml/document'
require 'rexml/entity'

# SECURE: Disable entity expansion in REXML
class SecureREXMLParser
  def self.parse(xml_string)
    # Reject if contains DOCTYPE (strictest approach)
    if xml_string =~ /<!DOCTYPE/i
      raise SecurityError, "DOCTYPE not allowed"
    end
    
    # Create document
    doc = REXML::Document.new(xml_string)
    
    # Verify no entities were expanded
    check_for_entities(doc)
    
    doc
  end
  
  # SECURE: Alternative - limit entity expansion
  def self.parse_with_limit(xml_string)
    # Set entity expansion limit (prevents billion laughs)
    REXML::Security.entity_expansion_limit = 1000
    REXML::Security.entity_expansion_text_limit = 10240
    
    doc = REXML::Document.new(xml_string)
    doc
  end
  
  private
  
  def self.check_for_entities(doc)
    # Check for entity references in document
    doc.each_element do |element|
      element.attributes.each do |name, value|
        if value.to_s.include?('&')
          raise SecurityError, "Entity reference detected"
        end
      end
    end
  end
end

# Usage:
begin
  doc = SecureREXMLParser.parse(xml_string)
  # Process document...
rescue SecurityError => e
  puts "Security error: #{e.message}"
end

REXML Vulnerable Example

Rubyrexml_vulnerable.rb⚠️ Vulnerable
require 'rexml/document'

# VULNERABLE: Default REXML parsing
def parse_xml(xml_string)
  # This is VULNERABLE! External entities will be expanded
  doc = REXML::Document.new(xml_string)
  doc
end

# Example vulnerable usage:
xml = <<-XML
<?xml version="1.0"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>
  <data>&xxe;</data>
</root>
XML

doc = parse_xml(xml)
# The &xxe; entity will be expanded to /etc/passwd contents!
puts doc.elements['root/data'].text
# Output: Contents of /etc/passwd

# VULNERABLE: Even with entity expansion limits, still risky
REXML::Security.entity_expansion_limit = 100
doc = REXML::Document.new(xml_string)
# Still vulnerable to file disclosure and SSRF!

Ox Parser (Safe - No External Entity Support)

Ox Security: Ox is a fast XML parser that does NOT support external entities, making it inherently safe from XXE.

Security Features:

No external entity support
No DTD processing
Fast performance
Simple API

Limitations:

Cannot validate against DTDs
Limited DOM manipulation
Less feature-rich than Nokogiri

Use Case: Good choice for parsing untrusted XML when you don't need DTD validation and want guaranteed XXE safety.

Ox Secure Usage

Rubyox_secure.rb✓ Secure
require 'ox'

# SECURE: Ox doesn't support external entities
def parse_with_ox(xml_string)
  # Safe - Ox doesn't process external entities
  doc = Ox.parse(xml_string)
  doc
end

# Example usage:
xml = <<-XML
<?xml version="1.0"?>
<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>
  <data>&xxe;</data>
</root>
XML

doc = parse_with_ox(xml)
# Ox will NOT expand the &xxe; entity
# The entity reference will be ignored or left as-is

# Additional Ox features
class XMLHandler
  def self.parse_safe(xml_string)
    # Ox options for strict parsing
    doc = Ox.parse(xml_string, mode: :hash, symbolize_keys: false)
    doc
  rescue Ox::ParseError => e
    { error: 'Invalid XML format' }
  end
end

Rails XML Parsing Security

Rails XML Parameter Parsing: Rails automatically parses XML request bodies. Ensure secure configuration.

Rails 6.1+:

Uses Nokogiri by default (safe)
External entities not expanded
No additional configuration needed

Rails < 6.1:

May use REXML or older Nokogiri
Verify Nokogiri version >= 1.5.4
Consider disabling XML parameter parsing if not needed

Disable XML Parsing (if not needed):

# config/initializers/disable_xml.rb
ActionDispatch::ParamsParser::DEFAULT_PARSERS.delete(Mime[:xml])

Explicit Safe Parsing:

# Use Nokogiri explicitly in controllers
class APIController < ApplicationController
  def parse_xml
    xml_doc = Nokogiri::XML(request.body.read) do |config|
      config.strict.nonet
    end
    # Process...
  end
end

Rails Secure XML Controller

Rubyxml_controller.rb✓ Secure
# app/controllers/xml_controller.rb
class XMLController < ApplicationController
  # Skip CSRF for API endpoints (use authentication instead)
  skip_before_action :verify_authenticity_token
  
  before_action :validate_content_type
  before_action :validate_xml_size
  
  def create
    xml_string = request.body.read
    
    # Parse securely with Nokogiri
    doc = parse_xml_secure(xml_string)
    
    # Extract data from XML
    data = extract_data(doc)
    
    # Process data...
    render json: { success: true, data: data }
  rescue Nokogiri::XML::SyntaxError => e
    render json: { error: 'Invalid XML syntax' }, status: 400
  rescue SecurityError => e
    render json: { error: 'Security violation detected' }, status: 403
  end
  
  private
  
  def validate_content_type
    unless request.content_type == 'application/xml'
      render json: { error: 'Invalid content type' }, status: 415
    end
  end
  
  def validate_xml_size
    max_size = 1.megabyte
    if request.body.size > max_size
      render json: { error: 'XML too large' }, status: 413
    end
  end
  
  def parse_xml_secure(xml_string)
    # Reject DOCTYPE if not needed
    if xml_string =~ /<!DOCTYPE/i
      raise SecurityError, 'DOCTYPE not allowed'
    end
    
    # Parse with strict, safe options
    Nokogiri::XML(xml_string) do |config|
      config.strict.nonet.noblanks
    end
  end
  
  def extract_data(doc)
    # Safely extract data from parsed XML
    {
      name: doc.at_xpath('//name')&.text,
      value: doc.at_xpath('//value')&.text
    }
  end
end

Sinatra Secure XML Endpoint

Rubysinatra_xml_app.rb✓ Secure
require 'sinatra'
require 'nokogiri'
require 'json'

# Sinatra app with secure XML parsing
class XMLApp < Sinatra::Base
  configure do
    set :max_xml_size, 1_048_576 # 1MB
  end
  
  post '/api/xml' do
    content_type :json
    
    # Validate content type
    halt 415, { error: 'Invalid content type' }.to_json unless
      request.content_type == 'application/xml'
    
    # Read and validate size
    xml_string = request.body.read
    halt 413, { error: 'XML too large' }.to_json if
      xml_string.bytesize > settings.max_xml_size
    
    # Reject DOCTYPE
    halt 403, { error: 'DOCTYPE not allowed' }.to_json if
      xml_string =~ /<!DOCTYPE/i
    
    begin
      # Parse securely
      doc = Nokogiri::XML(xml_string) do |config|
        config.strict.nonet.noblanks
      end
      
      # Process document
      result = process_xml(doc)
      
      { success: true, data: result }.to_json
    rescue Nokogiri::XML::SyntaxError => e
      halt 400, { error: 'Invalid XML syntax' }.to_json
    end
  end
  
  private
  
  def process_xml(doc)
    # Extract and return data
    {
      root: doc.root.name,
      elements: doc.root.elements.count
    }
  end
end

Testing XXE Prevention in Ruby

Rubyxxe_prevention_spec.rb✓ Secure
# spec/security/xxe_prevention_spec.rb
require 'rails_helper'

RSpec.describe 'XXE Prevention', type: :request do
  describe 'POST /api/xml' do
    let(:xxe_payload) do
      <<~XML
        <?xml version="1.0"?>
        <!DOCTYPE root [
          <!ENTITY xxe SYSTEM "file:///etc/passwd">
        ]>
        <root>
          <data>&xxe;</data>
        </root>
      XML
    end
    
    it 'rejects DOCTYPE declarations' do
      post '/api/xml',
           params: xxe_payload,
           headers: { 'CONTENT_TYPE' => 'application/xml' }
      
      expect(response).to have_http_status(:forbidden)
      expect(JSON.parse(response.body)['error']).to eq('DOCTYPE not allowed')
    end
    
    it 'does not expand external entities with Nokogiri' do
      # Even if DOCTYPE allowed, entities should not expand
      xml = '<?xml version="1.0"?><root><data>safe</data></root>'
      
      post '/api/xml',
           params: xml,
           headers: { 'CONTENT_TYPE' => 'application/xml' }
      
      expect(response).to have_http_status(:success)
    end
    
    it 'rejects oversized XML' do
      large_xml = '<root>' + 'a' * 2_000_000 + '</root>'
      
      post '/api/xml',
           params: large_xml,
           headers: { 'CONTENT_TYPE' => 'application/xml' }
      
      expect(response).to have_http_status(413)
    end
  end
end

Ruby XXE Prevention Checklist

☐ Use Nokogiri 1.5.4 or later • Verify: nokogiri --version • Update if needed: gem update nokogiri

☐ Avoid REXML for untrusted input • If must use REXML, disable DOCTYPE • Set entity expansion limits • Validate input before parsing

☐ Never use NOENT or DTDLOAD options • Don't enable entity expansion • Don't load external DTDs

☐ Validate input before parsing • Check content type • Reject if contains DOCTYPE (if not needed) • Enforce size limits

☐ Use strict parsing options • config.strict.nonet • Catch Nokogiri::XML::SyntaxError

☐ Test XXE prevention • Include security tests in test suite • Test with actual XXE payloads • Verify entities not expanded

☐ Rails-specific • Verify Nokogiri version in Gemfile.lock • Consider disabling XML parsing if not needed • Use explicit parsing in controllers

☐ Dependencies • Run bundle audit regularly • Keep all gems updated • Monitor security advisories