การป้องกันการแทรกคำสั่ง XML และ LDAP

You have seen SQL, command, and XSS injection. Any interpreter that mixes untrusted input with structure is at risk. Two often-missed backend targets are XML parsers and LDAP directories.

XML External Entity (XXE) injection abuses XML parsers that resolve external entities. An attacker defines an entity that reads a local file or hits an internal URL.

• Read sensitive files from the server
• Perform server-side request forgery to internal services
• Cause denial of service via entity expansion

All from a parser feature most apps never need.

The core fix is to configure the parser to not resolve external entities or DTDs. This single setting closes XXE entirely.

Where possible, accept JSON instead of XML — it has no entity concept and no equivalent attack. If you must take XML, lock the parser down first.

LDAP directories are queried with filter strings. If user input is concatenated into a filter, an attacker can alter the query logic — the LDAP analog of SQL injection.

Submitting * or admin)(&) as a username can turn a precise filter into one that matches many entries or always succeeds, bypassing authentication.

Neutralize the special characters * ( ) \ NUL by escaping them before they enter a filter.

Best of all, use directory APIs that accept inputs as parameters rather than building filter strings by hand — the same principle that makes prepared SQL statements safe.

Across SQL, command, XML, and LDAP the rule is identical: never let untrusted input change the structure of a query or document. Separate code from data with parameterization, escaping, or safe parser config.

Add a layer of defense by validating input against an allow-list of acceptable values before it reaches any interpreter. Rejecting unexpected characters or formats early shrinks the attack surface for every injection class at once.

You extended injection defense to XML and LDAP:

• XXE abuses external entities — disable DTDs and entity resolution
• LDAP injection manipulates filters — escape special characters or use parameterized APIs
• The universal rule: keep untrusted data out of structure