{"@ID": "112", "@Name": "Missing XML Validation", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Draft", "Description": "The product accepts XML from an untrusted source but does not validate the XML against the proper schema.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "1286", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "20", "@View_ID": "700", "@Ordinal": "Primary"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation", "Note": "The programmer might assume that a provided XML document is well-formed."}}, "Common_Consequences": {"Consequence": {"Scope": "Integrity", "Impact": ["Unexpected State", "Varies by Context"], "Note": "By accepting an XML document without validating it against a DTD or XML schema, the programmer leaves a door open for attackers to provide unexpected, unreasonable, or malicious input."}}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": {"Phase": "Architecture and Design", "Strategy": "Input Validation", "Description": {"xhtml:p": ["Always validate XML input against a known XML Schema or DTD.", "It is not possible for an XML parser to validate all aspects of a document's content because a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document's structure and therefore guarantee to the code that processes the document that the content is well-formed."], "#text_blocks": ["Always validate XML input against a known XML Schema or DTD.", "It is not possible for an XML parser to validate all aspects of a document's content because a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document's structure and therefore guarantee to the code that processes the document that the content is well-formed."]}}}, "Demonstrative_Examples": {"Demonstrative_Example": [{"Intro_Text": "The following code loads and parses an XML file.", "Example_Code": {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "xhtml:i": "// Read DOM", "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null], "#text": "...DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();factory.setValidating( false );....c_dom = factory.newDocumentBuilder().parse( xmlFile );"}, {"@style": "margin-left:1em;", "#text": "..."}], "#text": "try {} catch(Exception ex) {}"}, "#text_blocks": ["// Read DOM", "try {", "...", "DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();", "factory.setValidating( false );", "....", "c_dom = factory.newDocumentBuilder().parse( xmlFile );", "} catch(Exception ex) {", "...", "}"]}, "Body_Text": "The XML file is loaded without validating it against a known XML Schema or DTD."}, {"Intro_Text": "The following code creates a DocumentBuilder object to be used in building an XML document.", "Example_Code": {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "#text": "DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();builderFactory.setNamespaceAware(true);DocumentBuilder builder = builderFactory.newDocumentBuilder();"}, "#text_blocks": ["DocumentBuilderFactory builderFactory = DocumentBuilderFactory.newInstance();", "builderFactory.setNamespaceAware(true);", "DocumentBuilder builder = builderFactory.newDocumentBuilder();"]}, "Body_Text": "The DocumentBuilder object does not validate an XML document against a schema, making it possible to create an invalid XML document."}, {"Intro_Text": {"xhtml:p": "The following PHP code receives XML content from an HTTP request body,\n                     loads the XML content into a PHP SimpleXMLElement Object ($xml), and prints\n                     the results back to the user.", "#text_blocks": ["The following PHP code receives XML content from an HTTP request body,\n                     loads the XML content into a PHP SimpleXMLElement Object ($xml), and prints\n                     the results back to the user."]}, "Example_Code": [{"@Nature": "Bad", "@Language": "PHP", "xhtml:br": [null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null], "#text": "http_response_code(400);\n                        exit('No XML content received.');"}, "#text": "$xmlContent = file_get_contents('php://input');\n                     if (empty($xmlContent)) {\n                     \n                     }\n                     $xml = simplexml_load_string($xmlContent, 'SimpleXMLElement');\n                     echo $xml->asXML();", "#text_blocks": ["$xmlContent = file_get_contents('php://input');", "if (empty($xmlContent)) {", "http_response_code(400);", "exit('No XML content received.');", "}", "$xml = simplexml_load_string($xmlContent, 'SimpleXMLElement');", "echo $xml->asXML();"]}, {"@Nature": "Good", "@Language": "PHP", "xhtml:br": [null, null, null, null, null, null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null], "#text": "http_response_code(400);\n                        exit('Invalid XML file.');"}, "#text": "$xmlContent = file_get_contents('php://input');\n                     // We skip a check that $xmlContent is empty\n                     // Disable external entity loading to prevent XXE\n                     libxml_disable_entity_loader(true);\n                     libxml_use_internal_errors(true);\n                     $dom = new DOMDocument();\n                     $dom->loadXML($xmlString, LIBXML_NONET);\n                     if (!$dom->schemaValidate('/xml/schema.xsd')) {\n\n                     \n                     }\n                     echo $dom->saveXML();", "#text_blocks": ["$xmlContent = file_get_contents('php://input');", "// We skip a check that $xmlContent is empty", "// Disable external entity loading to prevent XXE", "libxml_disable_entity_loader(true);", "libxml_use_internal_errors(true);", "$dom = new DOMDocument();", "$dom->loadXML($xmlString, LIBXML_NONET);", "if (!$dom->schemaValidate('/xml/schema.xsd')) {", "http_response_code(400);", "exit('Invalid XML file.');", "}", "echo $dom->saveXML();"]}], "Body_Text": [{"xhtml:p": ["The above PHP code is vulnerable because it directly loads XML from\n                     user-controlled input. It might assume that the XML is already\n                     compliant with the schema. According to PHP documentation,\n                     simplexml_load_string() only assumes a \"well-formed XML\n                     string\" [REF-1551]. So, the code does not actually validate its\n                     structure against a schema (XSD) or a Document Type Definition (DTD).", "If the XML does not comply with the expected schema, this lack of\n                     validation could result in the application processing and handling\n                     malformed or unexpected data.", "A separate validation step can ensure that any provided data is valid\n                     with respect to the expected XSD/DTD, to address CWE-112."], "#text_blocks": ["The above PHP code is vulnerable because it directly loads XML from\n                     user-controlled input. It might assume that the XML is already\n                     compliant with the schema. According to PHP documentation,\n                     simplexml_load_string() only assumes a \"well-formed XML\n                     string\" [REF-1551]. So, the code does not actually validate its\n                     structure against a schema (XSD) or a Document Type Definition (DTD).", "If the XML does not comply with the expected schema, this lack of\n                     validation could result in the application processing and handling\n                     malformed or unexpected data.", "A separate validation step can ensure that any provided data is valid\n                     with respect to the expected XSD/DTD, to address CWE-112."]}, {"xhtml:p": "Note that the validation step in this code could be inefficient if it\n                     is only applied to inherently trusted files, but there are some\n                     scenarios in which an application must accept externally-submitted\n                     XML. In such cases, the schema validation could occur at an earlier\n                     step.", "#text_blocks": ["Note that the validation step in this code could be inefficient if it\n                     is only applied to inherently trusted files, but there are some\n                     scenarios in which an application must accept externally-submitted\n                     XML. In such cases, the schema validation could occur at an earlier\n                     step."]}]}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "7 Pernicious Kingdoms", "Entry_Name": "Missing XML Validation"}, {"@Taxonomy_Name": "Software Fault Patterns", "Entry_ID": "SFP24", "Entry_Name": "Tainted input to command"}]}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "230"}, {"@CAPEC_ID": "231"}]}, "References": {"Reference": [{"@External_Reference_ID": "REF-6"}, {"@External_Reference_ID": "REF-1551"}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "7 Pernicious Kingdoms", "Submission_Date": "2006-07-19", "Submission_Version": "Draft 3", "Submission_ReleaseDate": "2006-07-19"}, "Modification": [{"Modification_Name": "Sean Eidemiller", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "added/updated demonstrative examples"}, {"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Demonstrative_Example, Potential_Mitigations, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Relationships, Other_Notes, Taxonomy_Mappings, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-11-24", "Modification_Version": "1.1", "Modification_ReleaseDate": "2008-11-25", "Modification_Comment": "updated Description, Other_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-05-27", "Modification_Version": "1.4", "Modification_ReleaseDate": "2009-05-27", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-10-29", "Modification_Version": "1.6", "Modification_ReleaseDate": "2009-10-29", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-27", "Modification_Version": "2.0", "Modification_ReleaseDate": "2011-06-27", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2013-02-21", "Modification_Version": "2.4", "Modification_ReleaseDate": "2013-02-21", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-02-18", "Modification_Version": "2.6", "Modification_ReleaseDate": "2014-02-19", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Demonstrative_Examples, Other_Notes, Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Demonstrative_Examples, Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-01-19", "Modification_Version": "2.10", "Modification_ReleaseDate": "2017-01-19", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Applicable_Platforms, Causal_Nature, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated References, Related_Attack_Patterns, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Detection_Factors, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, References"}], "Contribution": {"@Type": "Content", "Contribution_Name": "Affan Ahmed", "Contribution_Date": "2025-02-28", "Contribution_Version": "5.0", "Contribution_ReleaseDate": "2026-10-28", "Contribution_Comment": "Contributed a PHP demonstrative example."}}, "entry_type": "Weakness"}