demo · v144
XXE Payload Replay
A field guide of canonical XXE payloads from OWASP. Click run on any of them; the replayer feeds the payload into DOMParser and reports what your browser actually does. In Chrome 144 every external-entity case should resolve to nothing.
DOMParser: checking… · XML external entities resolved: unknown
the API
const parser = new DOMParser();
const doc = parser.parseFromString(xmlString, "application/xml");
// In Chrome 143 and below, the SYSTEM identifier on a DOCTYPE entity
// could trigger a synchronous fetch. In Chrome 144 the parser ignores
// external references entirely — entity expands to an empty string.