Xml External Entities in Buffalo with Bearer Tokens

Buffalo is a web framework for Go that encourages rapid development and straightforward request handling. When an endpoint in a Buffalo application parses XML from untrusted sources without disabling external entity processing, an attacker can supply a malicious XML payload that references external entities (XXE). If that same endpoint requires authorization via Bearer Tokens in HTTP Authorization headers, the vulnerability can be chained to trusted context: the attacker learns whether authentication is required, probes the protected route with a crafted XML body, and potentially causes the server to read local files, interact with internal services, or participate in SSRF.

Consider a Buffalo handler that receives an XML document to update a user profile. If the handler uses a standard XML decoder without disabling DTDs and external entities, an attacker can provide an XML body like the following, which attempts to exfiltrate a file via a custom entity:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ELEMENT foo ANY >
               <!ENTITY xxe SYSTEM "file:///etc/passwd" >] >
<foo>&xxe;</foo>

When the server decodes this payload, the entity &xxe; is expanded to the contents of /etc/passwd, which may be returned in error messages or logged in ways that expose sensitive information. Because the endpoint validates the presence of a Bearer Token before processing business logic, an attacker first obtains or guesses a valid token (or uses an absent/weak token enforcement) to determine authorization requirements. They then send the malicious XML in the request body with the Authorization header set as Authorization: Bearer <token>. If token validation is flawed or the endpoint trusts the authenticated identity without additional checks, the server may disclose data or allow further internal probing, turning a logic-only XXE into an authenticated information leak.

The risk is compounded when the API surface includes OpenAPI specs with securitySchemes defined as bearerAuth. Clients may assume that presenting a Bearer Token is sufficient, but the server must still enforce strict input validation and secure XML parsing. Without disabling external entities, any authenticated route accepting XML can become an XXE vector. The scanner’s 12 checks run in parallel and include Input Validation and Data Exposure tests; they detect whether XML parsing is configured safely and whether sensitive information is returned in error responses that include Authorization context. Findings highlight insecure defaults and provide remediation guidance rather than attempting to fix or block requests.

Remediation focuses on two areas: securely handling Bearer Token authorization and hardening XML parsing to prevent XXE. For authorization, prefer explicit validation of the token, avoid leaking whether a token is valid via timing differences or error messages, and enforce scope and audience checks as appropriate. For XML, disable external entity processing and use restrictive parsers that do not expand DTDs.

Below is a minimal, secure Buffalo handler that combines both aspects. It verifies the Bearer Token against an expected value (in practice, use a verified introspection or validation routine), then parses XML with external entities disabled:

// main.go
package app

import (
    "encoding/xml"
    "net/http"
    "strings"

    "github.com/gobuffalo/buffalo"
)

// ExpectedToken is an example; use a robust validation method in production.
const ExpectedToken = "s3cr3tT0k3n"

type ProfileUpdate struct {
    Name  string `xml:"name"`
    Email string `xml:"email"`
}

func safeProfileHandler(c buffalo.Context) error {
    // Bearer Token validation
    auth := c.Request().Header.Get("Authorization")
    if auth == "" {
        c.Response().WriteHeader(http.StatusUnauthorized)
        return c.Render(401, r.JSON(map[string]string{"error": "authorization required"}))
    }
    const bearerPrefix = "Bearer "
    if !strings.HasPrefix(auth, bearerPrefix) {
        c.Response().WriteHeader(http.StatusUnauthorized)
        return c.Render(401, r.JSON(map[string]string{"error": "invalid authorization header format"}))
    }
    token := strings.TrimPrefix(auth, bearerPrefix)
    if token != ExpectedToken {
        c.Response().WriteHeader(http.StatusForbidden)
        return c.Render(403, r.JSON(map[string]string{"error": "invalid token"}))
    }

    // Secure XML parsing: no external entities
    decoder := xml.NewDecoder(c.Request().Body)
    decoder.Entity = xml.HTMLEntity
    decoder.Strict = true
    decoder.AutoClose = xml.HTMLAutoClose
    decoder.CharsetReader = xml.HTMLCharsetReader

    var profile ProfileUpdate
    if err := decoder.Decode(&profile); err != nil {
        c.Response().WriteHeader(http.StatusBadRequest)
        return c.Render(400, r.JSON(map[string]string{"error": "invalid XML"}))
    }

    // Process profile update safely
    c.Response().WriteHeader(http.StatusOK)
    return c.Render(200, r.JSON(map[string]string{"name": profile.Name, "email": profile.Email}))
}

Key security practices illustrated:

• Check for the presence and correct scheme of the Authorization header before inspecting the token.
• Use constant-time comparisons or a verified validation function for tokens in production; avoid early returns that disclose whether a token is valid via different error messages or timing.
• Configure the XML decoder to reject external entities by not enabling DTD processing; avoid legacy or permissive parsers that expand entities by default.
• Return consistent error shapes and status codes to prevent information leakage that could aid an attacker in refining token or XXE probes.

These steps reduce the attack surface for both authorization bypass and XXE when combined. The scanner’s LLM/AI Security checks are not applicable here because this scenario involves traditional API and XML handling rather than LLM endpoints; however, the standard checks for Authentication, Input Validation, and Data Exposure remain relevant and surface insecure configurations.