I am trying to understand the concept behind XXE (XML External Entity injection). I went through OWASP Guidelines on XXE
And since I am new to XML and DTD, I went through the W3Cschools tutorials as well on these topics. Now as per my readings I tried creating a demo of XXE. So below is my attempt to do the same : -
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE note [ <!ELEMENT note (to,from,heading,body,author)> <!ELEMENT to (#PCDATA)> <!ELEMENT from (#PCDATA)> <!ELEMENT heading (#PCDATA)> <!ELEMENT body (#PCDATA)> <!ENTITY writer "Donald Duck."> <!ENTITY copyright "Copyright W3Schools"> <!ENTITY attack SYSTEM "file:///Users/testuser/Desktop/BB/demos/test.txt"> ]> <note> <to>Tove</to> <from>Jani</from> <heading>Reminder</heading> <body>Don't forget me this weekend</body> <author>&writer;©right;&attack;</author> </note>
And in the path
I have a file test.txt that contains a string say :-
this is secret stuff
Now, when I open my XML file in Firefox it gives me the tree structure of my XML document and as expected it expands the entities writer and copyright with their respective content as defined in the DTD. However, the XML parser did not expand the entity "attack", which should have happened as has been demonstrated in the link given above.
Now I would like to know why was the entity attack not expanded. And secondly, even if it were expanded, will the file permissions (of the local file system) not come into play here?