003-XXE 防御

## XXE 防御

使用语言中推荐的禁用外部实体的方法

**PHP：**

“`php
libxml_disable_entity_loader(true);

“`

**JAVA:**

“`java
DocumentBuilderFactory dbf =DocumentBuilderFactory.newInstance();
dbf.setExpandEntityReferences(false);

.setFeature(“http://apache.org/xml/features/disallow-doctype-decl”,true);

.setFeature(“http://xml.org/sax/features/external-general-entities”,false)

.setFeature(“http://xml.org/sax/features/external-parameter-entities”,false);

“`

**Python：**

“`python
from lxml import etree
xmlData = etree.parse(xmlSource,etree.XMLParser(resolve_entities=False))

“`