XXE Risk Checker
Scan XML for external entity declarations and DOCTYPE constructs that indicate XXE exposure — flags only, no execution.
What is XXE Risk Checker?
A static risk scan for XML External Entity exposure. It does not parse entities, resolve identifiers or execute anything — it reads a document and reports the constructs that turn a parser into a file reader when the library is misconfigured.
How it works
The DOCTYPE is examined, along with every entity declaration in the internal subset, the presence of an external identifier, parameter entities, and any XInclude. Findings are graded by what a naive parser would do with them — SYSTEM and PUBLIC entities and parameter entities are errors, an external DTD subset and XInclude are warnings — and the report ends with the parser settings that remove the exposure. A hardening checklist is available with the output.
- Paste the document. Drop in XML, a schema, a feed or an XPath expression. Everything is parsed in the page: no upload, no server round trip, and the tools keep working with the network switched off.
- Set the options that match your document. Indent unit, whether to keep comments, which dialect, which output method. The defaults are the safe ones — nothing that changes meaning is enabled for you.
- Read the result, then copy or download it. Results appear as you type, copy straight to the clipboard, and download with a sensible filename (.xml, .xsd, .csv). Reset returns every field to its default.
Examples
A minified document from an API response
Paste one line of XML and the Formatter indents it, wraps long start tags one attribute per line and normalises empty elements — without touching text inside mixed content.
An XPath that works in Chrome and not in your servlet
The XPath Tester evaluates against a real tree and reports the axis or function it cannot support, instead of returning zero nodes and letting you guess why.
A document that will not parse
The Validator gives line and column for every mismatched tag, stray ampersand and duplicate attribute, with the reason in words: which open element was expected, which was found.
A schema that only half matches your data
The XSD Validator marks each violation with the path of the offending node, and the Schema Generator goes the other way — inferring a starting-point XSD from real documents.
Common mistakes
Assuming a pretty-printer cannot change meaning
Whitespace between elements is often insignificant, but inside mixed content it is not: `<p>Hello <b>world</b></p>` must stay on one line. Formatting here re-indents element-only content and leaves mixed content alone.
Treating a validation pass as proof of interoperability
The DTD and XSD validators implement honest subsets. A document reported valid here can still be rejected by a full validator that understands identity constraints, substitution groups or XSD 1.1 assertions — each page lists what it does not cover.
Reading the whole document because the parser did
A DOCTYPE is not inert. If your parser resolves external entities, pasting an untrusted document is enough to read a file or call an internal URL. The XXE Risk Checker shows what a document asks for; the fix is in the parser configuration.
Forgetting that attributes and elements are not interchangeable
`<id>1</id>` and `id="1"` mean different things to every schema and every XPath. When converting to CSV or YAML the distinction is preserved (`@id`), because flattening it away is the change that costs an afternoon later.
Frequently asked questions
If the scan is clean, am I safe?
It means this document cannot trigger XXE. It says nothing about the other direction — a document without a DOCTYPE is exactly what an attacker sends first to test whether your parser is misconfigured, and the safe answer is to disable DTD processing regardless of what arrives.
Should I just block the string <!DOCTYPE?
No. Input filtering is defeated by encodings, wrappers and whitespace, and you will break every legitimate document that has an internal subset. Disabling DTD and external-entity processing in the parser is the fix; filtering is the thing that looks like one.
Is pasting a malicious document here dangerous?
No. This page never resolves an identifier and never expands an entity — it scans the text and reports. The document is not parsed with entity processing enabled, and nothing is uploaded.