XXE external entity test XML

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

Python's standard parser (expat 2.4.1 or later) refuses entity-expansion bombs and does not fetch external entities, so this file fails to parse instead of attacking you. Parsers in other languages differ: make sure DTDs and external entities are disabled in yours. For untrusted XML in Python, the defusedxml package forbids entity declarations outright.

import xml.etree.ElementTree as ET

try:
    ET.parse("xxe-file-disclosure.xml")
    print("parsed")
except ET.ParseError as e:
    print("refused:", e)

Run against this file, it prints: refused: undefined entity &xxe;: line 6, column 8