XXE (XML External Entity) Security Check

Analyze PHP code for XXE vulnerabilities (OWASP A03:2021).

Detection Patterns

1. SimpleXML without Protection

// CRITICAL: User input directly to simplexml
$xml = simplexml_load_string($_POST['xml']);
$xml = simplexml_load_file($_FILES['upload']['tmp_name']);

// CRITICAL: Default options allow entities
$xml = new SimpleXMLElement($userInput);

// VULNERABLE: LIBXML_NOENT enables entity substitution
$xml = simplexml_load_string($data, 'SimpleXMLElement', LIBXML_NOENT);