Xml External Entities in Adonisjs with Basic Auth

XML External Entity (XXE) injection occurs when an application processes XML input and allows an attacker to define or reference external entities, leading to file disclosure, SSRF, or denial of service. In AdonisJS, this risk arises when XML parsing is enabled—commonly through libraries used to process SOAP payloads, legacy integrations, or file uploads that accept XML. If an endpoint accepts XML and parses it without strict schema validation and entity disabling, an attacker can embed malicious external entity definitions that read local files or trigger network requests.

When Basic Auth is used for endpoint authentication, it primarily protects the HTTP entry point, but it does not affect how the application handles XML once authenticated. A developer may assume that requiring a username and password mitigates injection risks; however, XXE operates at the parsing stage, after authentication succeeds. If the authenticated session exposes an XML-processing route—such as an import or configuration endpoint—an attacker can still leverage XXE to read files like /etc/passwd or interact with internal services reachable from the server. Because middleBrick scans the unauthenticated attack surface, it can detect endpoints that accept XML input and identify missing entity restrictions even when Basic Auth is present, highlighting that authentication and input validation are separate concerns.

The combination therefore exposes a common misconception: protecting transport access does not protect data processing logic. AdonisJS applications that parse XML without disabling external entities remain vulnerable regardless of the authentication scheme. Attack patterns include using crafted XML with DOCTYPE declarations to traverse file system paths or trigger SSRF via file:// or http:// references. The presence of Basic Auth may also lead to less rigorous testing, as developers assume the endpoint is already secured. Effective mitigation requires explicitly disabling external entities in the XML parser and validating incoming structures against a strict schema, complemented by scanning practices that verify the unauthenticated attack surface for exposed XML endpoints.

To remediate XXE in AdonisJS while using Basic Auth, ensure XML parsing explicitly disables external entities and DTDs. Below are concrete, working examples that combine secure XML handling with Basic Auth credentials. These examples assume usage of an XML parser library compatible with Node.js, such as xmldom or similar packages, and demonstrate how to integrate parsing safely within a route handler.

Secure XML parsing with external entity disabled

const { DOMParser } = require('@xmldom/xmldom');
const parser = new DOMParser({
  // Explicitly disable loading external entities
  externalGeneralEntities: false,
  externalParameterEntities: false,
  feature: 'http://apache.org/xml/features/disallow-doctype-decl',
});

function parseSecureXml(xmlString) {
  try {
    const document = parser.parseFromString(xmlString, 'text/xml');
    // Validate structure and extract data safely
    return document.documentElement;
  } catch (error) {
    // Handle parsing errors without exposing internals
    throw new Error('Invalid XML');
  }
}

Route with Basic Auth and secure parsing

// routes.js
import { router } from '@adonisjs/core/framework/router';
import { authenticateBasic } from './auth.js';

router.post('/import', authenticateBasic, async ({ request, response }) => {
  const xmlPayload = request.input('xml');
  if (!xmlPayload) {
    return response.badRequest({ error: 'XML payload required' });
  }

  const parsed = parseSecureXml(xmlPayload);
  // Process parsed XML safely, avoiding any external entity references
  // Example: extract specific elements and validate against schema
  const items = parsed.getElementsByTagName('item');
  const results = Array.from(items).map(node => node.textContent);

  return response.ok({ imported: results.length });
});

// auth.js
export function authenticateBasic(ctx, next) {
  const authHeader = ctx.request.headers().authorization;
  if (!authHeader || !authHeader.startsWith('Basic ')) {
    ctx.response.status = 401;
    return { error: 'Unauthorized' };
  }
  const [user, pass] = Buffer.from(authHeader.slice(6), 'base64').toString().split(':');
  // Replace with secure credential verification, e.g., constant-time compare
  if (user !== 'admin' || pass !== 's3cr3t') {
    ctx.response.status = 403;
    return { error: 'Forbidden' };
  }
  return next();
}

These examples show how to integrate secure parsing alongside Basic Auth in AdonisJS. The parser configuration disables external entities and prohibits DOCTYPE declarations, which are common vectors for XXE. Authentication validates credentials before processing, but the core security against XXE comes from parser hardening. For broader protection, combine these practices with schema validation and use middleBrick to scan your endpoints, verifying that XML-handling routes do not expose external entity resolution even when Basic Auth is in place.