Xml External Entities in Buffalo with Dynamodb

XML External Entity (XXE) injection occurs when an application processes XML input that references external entities, and those entities are resolved in a way that exposes local files, triggers SSRF, or consumes excessive resources. In the Buffalo framework, this risk arises when XML payloads are parsed and the parsed data is used to interact with an AWS DynamoDB backend. If user-controlled XML is deserialized and subsequently used to construct DynamoDB API requests, attackers can leverage external entity declarations to read arbitrary files on the server or force outbound network calls to internal metadata services, effectively turning the DynamoDB client into a channel for data exfiltration.

Consider a scenario where a Buffalo application accepts an XML upload containing item data to be stored in a DynamoDB table. If the XML parser is configured to resolve external entities, an attacker can supply a payload such as <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><root><data>&xxe;</data></root>. When the parser processes this input, the &xxe; reference is replaced with the contents of /etc/passwd. If the application then maps the extracted data into a DynamoDB PutItem request, the sensitive file content may be written into the table or logged in error messages, creating a stealthy data exposure path.

The interaction with DynamoDB amplifies the impact because the database service is often assumed to be an isolated backend. In practice, the XXE-induced requests may include forged item structures that bypass expected validation, especially if the application relies on loosely typed deserialization. For example, an attacker can embed nested entities that expand to large strings or recursive structures, leading to exponential entity expansion and potential denial of service against the DynamoDB client. Because Buffalo does not enforce strict schema validation on XML-derived input before it reaches the database layer, the vulnerability maps directly to the OWASP API Top 10 brokenObjectLevelAuthorization and massAssignment when malicious item attributes override protected fields.

Moreover, if the Buffalo application runs in an environment with an attached IAM role (such as an EC2 instance or ECS task), the attacker can chain XXE with SSRF against the AWS metadata service (169.254.169.254). A crafted XML external entity like <!ENTITY metadata SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">> can be used to retrieve credentials, which are then used to sign further DynamoDB requests. This turns a local file read into cross-service credential theft, aligning with the LLM/AI Security checks in middleBrick that detect exposed endpoints and unusual data flows. The scanner flags such patterns by correlating runtime findings with the OpenAPI specification, highlighting where user-supplied XML reaches DynamoDB operations without adequate entity disabling.

To mitigate XXE in a Buffalo application that interacts with DynamoDB, you must disable external entity resolution at the XML parser level and enforce strict input validation before constructing database requests. Below are concrete code examples using the official AWS SDK for Go and the Buffalo framework.

1. Disable external entities in the XML parser

When unmarshaling XML, configure the parser to reject DOCTYPE declarations and external entities. In Go, this is achieved by customizing the xml.Decoder and using a restrictive EntityResolver-like pattern via a custom CharsetReader or by pre-processing the input.

import (
    "encoding/xml"
    "io"
    "strings"
)

// safeXMLDecoder returns an XML decoder that disables external entities.
func safeXMLDecoder(r io.Reader) *xml.Decoder {
    decoder := xml.NewDecoder(io.LimitReader(r, 1024*1024)) // limit size
    decoder.CharsetReader = func(charset string, input io.Reader) (io.Reader, error) {
        // Reject any external subset by not resolving entities.
        return input, nil
    }
    return decoder
}

// Example usage in a Buffalo action.
func (v ItemController) Store(c buffalo.Context) error {
    body := c.Request().Body
    decoder := safeXMLDecoder(body)
    var item map[string]interface{}
    if err := decoder.Decode(&item); err != nil {
        return c.Render(400, r.JSON(map[string]string{"error": "invalid XML"}))
    }
    // Validate and sanitize item before sending to DynamoDB.
    return v.saveToDynamoDB(item)
}

2. Validate and sanitize before DynamoDB operations

Ensure that the data extracted from XML conforms to a strict schema and does not contain unexpected metadata or recursive structures. Use whitelisting for field names and types, and avoid directly passing user input into DynamoDB attribute values without type checks.

import "github.com/aws/aws-sdk-go/service/dynamodb"

func (v ItemController) saveToDynamoDB(data map[string]interface{}) error {
    // Whitelist allowed keys and enforce string types.
    allowed := map[string]bool{"name": true, "value": true}
    for k := range data {
        if !allowed[k] {
            return errors.New("disallowed field")
        }
    }

    item := make(map[string]*dynamodb.AttributeValue)
    if name, ok := data["name"].(string); ok {
        item["id"] = &dynamodb.AttributeValue{S: aws.String(name)}
    } else {
        return errors.New("invalid name type")
    }
    if value, ok := data["value"].(string); ok {
        item["content"] = &dynamodb.AttributeValue{S: aws.String(value)}
    } else {
        return errors.New("invalid value type")
    }

    svc := dynamodb.New(session.New())
    _, err := svc.PutItem(&dynamodb.PutItemInput{
        TableName: aws.String("SecureItems"),
        Item:      item,
    })
    return err
}

3. Secure the HTTP client and disable redirects

Prevent SSRF by ensuring that any HTTP client used within Buffalo (for example, to fetch external resources) does not follow redirects to internal IP ranges. Combine this with network-level restrictions so that the DynamoDB client cannot reach the metadata service.

import "net/http"

func newSecureClient() *http.Client {
    return &http.Client{
        CheckRedirect: func(req *http.Request, via []*http.Request) error {
            return http.ErrUseLastResponse
        },
    }
}

By combining parser hardening, strict schema validation, and network controls, the Buffalo application can safely handle XML input while protecting DynamoDB operations. middleBrick can be used in the CI/CD pipeline to verify that these mitigations are reflected in the API specification and runtime behavior, ensuring that XXE-related findings are addressed before deployment.