XXE in LxmlEventHandler.parse()

docs/data_binding/basics.md

@@ -98,6 +98,17 @@ Enable loading external dtd with
 
 **Default:** `False`
 
+### `resolve_entities`
+
+Enable loading of external reference within XML documents with
+[LxmlEventHandler][xsdata.formats.dataclass.parsers.handlers.LxmlEventHandler]. Enabling
+this option has security implications: the code becomes vulnerable for External Entity
+Injection (XXE).
+
+**Type:** `bool`
+
+**Default:** `False`
+
 ### `class_factory`
 
 Override default object instantiation, to apply pre/post-initialization logic.

xsdata/formats/dataclass/parsers/config.py

@@ -30,6 +30,7 @@ class ParserConfig:
         base_url: Specify a base URL when parsing from memory, and
             you need support for relative links e.g. xinclude
         load_dtd: Enable loading external dtd (lxml only)
+        resolve_entities: Enable resoling external entities (lxml only)
         process_xinclude: Enable xinclude statements processing
         class_factory: Override default object instantiation
         fail_on_unknown_properties: Skip unknown properties or fail with exception
@@ -39,6 +40,7 @@ class ParserConfig:
 
     base_url: str | None = None
     load_dtd: bool = False
+    resolve_entities: bool = False
     process_xinclude: bool = False
     class_factory: Callable[[type[T], dict[str, Any]], T] = field(
         default=default_class_factory

xsdata/formats/dataclass/parsers/handlers/lxml.py

@@ -37,6 +37,7 @@ def parse(self, source: Any, ns_map: dict[str | None, str]) -> Any:
                 recover=True,
                 remove_comments=True,
                 load_dtd=self.parser.config.load_dtd,
+                resolve_entities=self.parser.config.resolve_entities,
             )
 
         return self.process_context(ctx, ns_map)