Parsing and processing
Entity expansion attack
A denial of service in which nested entity definitions expand exponentially, turning a few hundred bytes of document into gigabytes of text.
Ten entities, each referencing the previous one ten times, is a factor of ten billion. The document is tiny, well-formed and needs no external resources at all — the parser does the damage entirely on its own, which is what makes it such an effective attack on any endpoint that accepts XML.
The defence is a limit rather than a pattern check: modern libxml2 tracks how far the input has been amplified and stops when the factor gets absurd. That limit is what the demonstration below reaches.
- Defined in
- OWASP
- Category
- Parsing and processing
- Also written
- billion laughs, XML bomb
Shown, not asserted
All 2 claims are executed on every test run, against the same engines the tools use. If the behaviour changes, the test fails rather than this page quietly becoming wrong.
A small expansion is ordinary entity behaviour and is performed.
document.xml <!DOCTYPE x [<!ENTITY a "aaaaaaaaaa"><!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;">]> <x>&b;</x>What the engine returns
Well-formed.Seven levels of the same trick trips the amplification limit and the parse is abandoned.
document.xml <!DOCTYPE lolz [<!ENTITY lol "lol"><!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"><!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"><!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"><!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"><!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"><!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">]> <lolz>&lol7;</lolz>What the engine returns
Maximum entity amplification factor exceeded, see xmlCtxtSetMaxAmplification.
What catches people out
- Document size tells you nothing about expanded size. Rate-limiting by bytes does not defend against this.
- The limit is a parser setting. An older library, or one configured for legacy documents, may have no limit at all.
- A recursive entity is a different failure: that one is caught as a loop rather than as amplification.
Where it bites
A definition on its own is trivia. These are the pages where this term decides whether a document works.
- Parse errorsDetected an entity reference loopThe related failure, when entities reference each other in a cycle.
- ToolsXML validatorThe pipeline whose limit is being reached above.
Related terms
- General entityAn entity declared with <!ENTITY name "text"> whose replacement text is substituted wherever &name; appears in content.
- Internal subsetThe markup declarations written inline between square brackets in a DOCTYPE, rather than fetched from an external DTD file.
- XXE (XML external entity attack)An attack in which a submitted document declares an external entity so that a trusting parser reads a local file or makes a request on the attacker's behalf.
- Document type declarationThe <!DOCTYPE root …> in the prolog that names the document's root element and points at, or contains, its markup declarations.
Get started
Bring order to the XML your team can't afford to ignore.
Create a free account and get a private workspace to search, validate, diff, and monitor your XML feeds, sitemaps, schemas, and vendor integrations.