refactor: Remove parser hardening examples from xxe prompt

This commit is contained in:
Ahmed Allam
2025-10-13 17:47:15 -07:00
committed by Ahmed Allam
parent 6d5a3f331b
commit f22acefd76

View File

@@ -145,46 +145,6 @@ evil.dtd:
</office_docs>
</special_contexts>
<parser_hardening>
<java>
```java
DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
f.setFeature("http://xml.org/sax/features/external-general-entities", false);
f.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
f.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
f.setAttribute("http://javax.xml.XMLConstants/property/accessExternalDTD", "");
f.setAttribute("http://javax.xml.XMLConstants/property/accessExternalSchema", "");
```
</java>
<dotnet>
```csharp
var settings = new XmlReaderSettings {
DtdProcessing = DtdProcessing.Prohibit,
XmlResolver = null
};
```
</dotnet>
<python>
```python
from lxml import etree
parser = etree.XMLParser(resolve_entities=False, no_network=True)
etree.fromstring(xml_bytes, parser)
# Prefer defusedxml for stdlib parsers
```
</python>
<php>
```php
$dom = new DOMDocument();
// Do NOT use LIBXML_NOENT; forbid network
$dom->loadXML($xml, LIBXML_NONET | LIBXML_NOERROR | LIBXML_NOWARNING);
```
</php>
</parser_hardening>
<validation>
1. Provide a minimal payload proving parser capability (DOCTYPE/XInclude/XSLT).
2. Demonstrate controlled access (file path or internal URL) with reproducible evidence.