Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using loadXML? The XML files are limited in size and will be under 2MB.
Could someone potentially create an XML files with a malicious macro?
https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing https://www.owasp.org/index.php/Testing_for_XML_Injection_(OWASP-DV-008)
I read these links but I am not sure if we could safely rely on loadXML or not? If not, what methods should we use to sanitize or validate an xml as safe?