liveBook · Manning

DTD

As explained in Grokking Web Application Security

A document type definition is an XML declaration that specifies the structure, elements, attributes, and entities permitted in a document.

A document type definition (DTD) describes the permitted structure of an XML document: its element names, ordering, content types, and attributes. Applications can use it to validate incoming XML, but DTD is legacy technology, largely replaced by more flexible XML schemas. section 11.5

Treat DTD support as a security boundary when accepting XML:

  • Disable inline DTD processing. An inline DTD is embedded in the submitted document, so an attacker controls its declarations. section 11.5 section 11.8
  • Watch for entity expansion. DTD entities act as string-substitution macros and can be nested until a small request expands into gigabytes of data. section 11.6
  • Harden the parser according to its platform. Options and libraries differ across Python, Ruby, Node.js, Java, and .NET. section 11.8

The billion-laughs attack

A malicious inline DTD can define lol, lol2, and successive entities that repeat one another. When the parser expands &lol9;, the document grows exponentially, potentially exhausting server memory and causing denial of service from a single HTTP request. section 11.6

<?xml version="1.0"?>
<!DOCTYPE lolz [
 <!ENTITY lol "lol">
 <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;">
 <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;">
 <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;">
 <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;">
 <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;">
 <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;">
 <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;">
 <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<lolz>&lol9;</lolz>

Inspect the nested entity declarations that demonstrate how recursive expansion creates an XML bomb. section 11.6

How Grokking Web Application Security covers it

How deep it goes
Explains structure, entity expansion, XML bombs, and parser mitigations, then stops short of comprehensive parser-hardening documentation.
Examples
Uses element declarations, entity substitution, and a nested billion-laughs payload to demonstrate validation and exploitation.
What it assumes
Assumes basic XML documents and parsing while defining DTD validation and entity expansion in practical terms.
What you can do after
Operate/configure XML parsers to disable inline DTDs and reduce XML bomb risk across common language ecosystems.
How it connects
Connects DTDs to XML validation, XML schemas, entity definitions, XML parsers, and denial-of-service attacks.
Cover of Grokking Web Application Security
liveBookmanning.com
Read Grokking Web Application Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Grokking Web Application Security. The section links point to the parts of the book it draws on.