Stopping XXE

Disable what you don't need

Virtually no application needs document-defined or external entities, so the fix is to turn them off at the parser:

Tip: Disable DTD processing and external-entity resolution in your XML parser (in Python, parse with defusedxml, or an lxml parser built with resolve_entities=False, no_network=True, load_dtd=False). Prefer simpler formats like JSON where XML isn't required, and never echo parser errors back to the caller.