CODEWITHSUNDEEP
xmldtdxxedtd-parsing
FunnyDeadCat
FunnyDeadCat

Reputation: 61

How to assign XML DTD entity to attribute value

My XML:

<?xml version="1.0"?>
<!DOCTYPE Input [  
    <!ELEMENT Input ANY >
    <!ENTITY xxe SYSTEM "file:///c:/test.txt" >]>
<ExecutionParameters>
  <Inputs>
    <Input Name="Input1" Value="VALUE_OF_XXE"></Input>
  </Inputs>
</ExecutionParameters>

I want to pass xxe (content of test.txt file) to the VALUE_OF_XXE.

Upvotes: 3

Views: 1284

Answers (1)

kjhughes
kjhughes

Reputation: 111716

You cannot reference an external entity from an XML attribute value; this is not allowed:

<Input Name="Input1" Value="&xxe;"></Input>

Alternatives

  1. Reference the external entity from an element value:

    <Input Name="Input1" Value="">&xxe;</Input>

  2. Reference an internal entity from an attribute value:

     <!ENTITY xie "Some text here" >]>

See also

Upvotes: 5

Related Questions