This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

OWASP Periodic Table of Vulnerabilities - SOAP Array Abuse, XML Attribute Blowup, XML Entity Expansion

Jump to: navigation, search

Return to Periodic Table Working View

SOAP Array Abuse, XML Attribute Blowup, XML Entity Expansion

Root Cause Summary

Some features of the XML specification can be abused if XML parsers do not safely handle recursive element definitions or array declarations.

Browser / Standards Solution


Perimeter Solution

Perimeter technologies should perform strict schema validation against all incoming XML documents. The validation process should enforce the following configurable limits on XML object definitions:

  • The maximum array size (as a product of the number of rows and columns)
  • The maximum number of elements
  • The maximum number of attributes per element
  • The maximum size of entity definitions
  • The maximum number of references to entity definitions

Generic Framework Solution


Custom Framework Solution


Custom Code Solution


Discussion / Controversy



SOAP Array Abuse (WASC)
XML Attribute Blowup (WASC)
XML Entity Expansion (WASC)