v144 · dom

Externally loaded entities in XML parsing

Chrome synchronously fetches external XML entities/DTDs and incorporates them into parsing under specific circumstances. I propose to remove this functionality.

concepts

  1. XXE Note

    Chrome's XML parser no longer follows external entity references. Closes a long-standing XXE vector that affected DOMParser and friends.

  2. XXE Side-by-Side

    Parse a safe internal-entity XML doc next to one that tries to fetch file:///etc/passwd via SYSTEM. Chrome 144 returns empty for the external entity.

  3. XXE Payload Replay

    A field guide of canonical XXE payloads — file://, HTTP exfil, parameter-entity DTD, billion-laughs. Click run on each and the replayer shows what your DOMParser actually does.

  4. Safe XML Parser

    Write any XML with entity declarations and parse it live. The entity audit panel classifies each declaration as internal (safe) or external/parameter (blocked in Chrome 144+) — a developer tool for auditing XML payloads before they reach your DOMParser.

why it shipped

The usage has continuously decreased and is at an extremely low level of 0.000015, compare: https://chromestatus.com/metrics/feature/timeline/popularity/529

references