Billion laughs XML bomb test file
Classic entity-expansion bomb: nine levels of entities each referencing the previous ten times. Under 1 KB on disk, expands to ~1 GB of text if entity expansion is unbounded.
↓ Download billion-laughs.xml| Filename | billion-laughs.xml |
| Format | XML |
| Size | 794 bytes (794 bytes) |
| MIME type | application/xml |
| SHA-256 | 9ca01fc0e877f248ff50f66de22330cbfb71785e34f26656cf68a0aac21f642c |
Handle it in code
Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.
Python
Python's standard parser (expat 2.4.1 or later) refuses entity-expansion bombs and does not fetch external entities, so this file fails to parse instead of attacking you. Parsers in other languages differ: make sure DTDs and external entities are disabled in yours. For untrusted XML in Python, the defusedxml package forbids entity declarations outright.
import xml.etree.ElementTree as ET
try:
ET.parse("billion-laughs.xml")
print("parsed")
except ET.ParseError as e:
print("refused:", e)Run against this file, it prints: refused: limit on input amplification factor (from DTD and entities) breached: line 14, column 6