salvacybersec/strix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: Remove parser hardening examples from xxe prompt

Browse Source
This commit is contained in:
Ahmed Allam
2025-10-13 17:47:15 -07:00
committed by Ahmed Allam
parent 6d5a3f331b
commit f22acefd76
1 changed files with 0 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
strix/prompts/vulnerabilities/xxe.jinja
View File

@@ -145,46 +145,6 @@ evil.dtd:
</office_docs> </office_docs>
</special_contexts> </special_contexts>
<parser_hardening>
<java>
```java
DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
f.setFeature("http://xml.org/sax/features/external-general-entities", false);
f.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
f.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", true);
f.setAttribute("http://javax.xml.XMLConstants/property/accessExternalDTD", "");
f.setAttribute("http://javax.xml.XMLConstants/property/accessExternalSchema", "");
```
</java>
<dotnet>
```csharp
var settings = new XmlReaderSettings {
DtdProcessing = DtdProcessing.Prohibit,
XmlResolver = null
};
```
</dotnet>
<python>
```python
from lxml import etree
parser = etree.XMLParser(resolve_entities=False, no_network=True)
etree.fromstring(xml_bytes, parser)
# Prefer defusedxml for stdlib parsers
```
</python>
<php>
```php
$dom = new DOMDocument();
// Do NOT use LIBXML_NOENT; forbid network
$dom->loadXML($xml, LIBXML_NONET | LIBXML_NOERROR | LIBXML_NOWARNING);
```
</php>
</parser_hardening>
<validation> <validation>
1. Provide a minimal payload proving parser capability (DOCTYPE/XInclude/XSLT). 1. Provide a minimal payload proving parser capability (DOCTYPE/XInclude/XSLT).
2. Demonstrate controlled access (file path or internal URL) with reproducible evidence. 2. Demonstrate controlled access (file path or internal URL) with reproducible evidence.