https://nalar.dev/tags/xml/ Recent content in XML on Nalar Hugo en-us Fri, 11 Sep 2026 00:00:00 +0700 https://nalar.dev/disable-external-entities-in-xml-parsers/ Fri, 11 Sep 2026 00:00:00 +0700 https://nalar.dev/disable-external-entities-in-xml-parsers/ <p>XML is a data format, but an XML parser can have capabilities that go far beyond reading elements and attributes. Depending on its configuration, a parser may process document type declarations, expand entities, access local files, or make network requests.</p> <p>Those capabilities can turn a data-processing boundary into a file-access or network-access boundary. An application that accepts XML from an untrusted source must therefore control parser features before parsing begins.</p>