Secure Backend SVG Processing: XML Settings to Disable

Scalable Vector Graphics (SVG) are XML-based image files, which exposes backend processing pipelines to severe security risks like XML External Entity (XXE) injection, Server-Side Request Forgery (SSRF), and XML entity expansion denial-of-service attacks (Billion Laughs). Securing backend SVG handling requires hardening the underlying XML parser. This guide details the exact XML parser configurations, features, and flags you must disable to ensure safe SVG processing.

1. Completely Disallow DOCTYPE Declarations

The most effective way to secure an XML parser processing SVGs is to disable Document Type Declarations (<!DOCTYPE>) entirely. Standard SVG files do not require custom DTDs to render or convert correctly.

• Java (DOM/SAX/StAX): Set the feature http://apache.org/xml/features/disallow-doctype-decl to true.
• Impact: The parser immediately rejects any SVG containing a <!DOCTYPE> tag, preventing XXE and entity-based attacks at the root.

2. Disable External Entity Resolution

If your application cannot completely disallow DOCTYPEs, you must disable the loading and resolution of external entities. This prevents attackers from exfiltrating local server files or forcing the server to make unauthorized network requests (SSRF).

• External General Entities: Disable http://xml.org/sax/features/external-general-entities (set to false).
• External Parameter Entities: Disable http://xml.org/sax/features/external-parameter-entities (set to false).
• External DTDs: Disable http://apache.org/xml/features/nonvalidating/load-external-dtd (set to false).
• libxml2 (PHP, Python lxml, C/C++):
  • Ensure XML_PARSE_NOENT is not set (in libxml2, NOENT actually substitutes entities, which expands them; leave this flag off).
  • Enable XML_PARSE_NONET to forbid network access for DTDs and entities.
  • In PHP, ensure libxml_disable_entity_loader(true) is set for older versions, or avoid entity substitution flags in DOMDocument::loadXML().

3. Disable XInclude Processing

XInclude allows XML documents to reference and merge external files via tags like <xi:include>. Attackers can use this to bypass entity restrictions and include arbitrary backend files.

• Java: Set DocumentBuilderFactory.setXIncludeAware(false) and NamespaceAware(true).
• libxml2: Ensure the XML_PARSE_XINCLUDE flag is omitted during parsing.

4. Restrict or Disable Entity Expansion (XML Bombs)

To mitigate Billion Laughs attacks—where nested entities consume all memory and CPU—parsers must not recursively expand custom internal entities.

• Python: Use hardened libraries such as defusedxml to parse untrusted SVGs rather than default xml.etree or insecure lxml configurations.
• Java: Set XMLConstants.FEATURE_SECURE_PROCESSING to true to enforce strict parsing limits, including entity expansion limits and depth recursion constraints.
• libxml2: Ensure XML_PARSE_HUGE is omitted. Enabling XML_PARSE_HUGE disables internal limits on entity expansion and line lengths, making the parser vulnerable to resource exhaustion.

Summary Checklist for Backend SVG Parsing

To securely accept and process SVG uploads: 1. Enable FEATURE_SECURE_PROCESSING. 2. Disable disallow-doctype-decl. 3. Disable external-general-entities and external-parameter-entities. 4. Disable load-external-dtd. 5. Disable XInclude capabilities. 6. Block outbound network access from the parser using flags like XML_PARSE_NONET.