CWE-112 (XML验证缺失) — Vulnerability Class 7

CWE-112 represents a critical input validation weakness where applications accept XML data from untrusted sources without verifying it against a defined Document Type Definition (DTD) or XML Schema. This oversight allows attackers to inject malformed, unexpected, or malicious structures that violate the programmer’s assumptions about expected data formats. Exploitation typically involves crafting specially designed XML payloads that trigger parsing errors, cause denial-of-service conditions through billion laughs attacks, or facilitate XML External Entity (XXE) injections to access sensitive files. To mitigate this risk, developers must rigorously validate all incoming XML documents against strict schemas before processing. Additionally, implementing secure XML parsers that disable external entity resolution and limiting the complexity of parsed structures are essential defensive measures. By enforcing strict validation rules, organizations can prevent attackers from exploiting structural ambiguities and ensure that only well-formed, expected data enters the system.