codejump
HardPro challengeJavaScriptTypeScript

XXE Prevention — Hardcode External Entities Off

JavaScriptSecurityXXE

The XML parser configuration below lets the *caller* decide whether external entity resolution and DTD processing are enabled.

The bug: an XML parser with external entity resolution turned on will fetch and inline the content of any URI an attacker's XML payload references — including file:///etc/passwd or an internal-network URL — a classic XML External Entity (XXE) attack that turns "parse this XML" into arbitrary file disclosure or server-side request forgery.

Your task: fix solve(requested) so it always returns { resolveExternalEntities: false, dtdProcessing: false }, completely ignoring whatever the caller asked for — this is a case where the setting must never be configurable by request.

Sample tests

Test #1No options requested — still safe by default
Input: [{}]
Output: {"dtdProcessing":false,"resolveExternalEntities":false}
Test #2Caller explicitly requests insecure options — still forced safe
Input: [{"dtdProcessing":true,"resolveExternalEntities":true}]
Output: {"dtdProcessing":false,"resolveExternalEntities":false}
Test #3Only one insecure flag requested — both still forced safe
Input: [{"dtdProcessing":true}]
Output: {"dtdProcessing":false,"resolveExternalEntities":false}
← All challenges