How XML turns a few bytes into a flood of text
XML lets a document define an entity—a named piece of text that the parser inserts wherever the name appears. That shortcut is useful for reusing text, but nested entities can make each definition refer to others that expand in turn.
An attacker can arrange the definitions in layers: one entity contains many copies of another, which contains many copies of the next. The file itself stays small because it stores the instructions for expansion, not the enormous result. When a parser resolves the names, the text multiplies at each layer, potentially consuming vast amounts of memory and processing time.
The danger is in the parser’s work
The name “billion laughs” comes from a classic example in which repeated expansions produce a huge amount of the word “lol.” The exact output depends on how the document is built and how the parser handles it; the key point is the mismatch between a compact input and an explosive amount of work.
A server can be overwhelmed while merely trying to read an XML file. If it handles incoming documents this way, an attacker may tie up resources needed for ordinary requests. This is a denial-of-service attack: the goal is to make a service unavailable, not necessarily to steal data.
Safe parsing limits the expansion
XML parsers can defend against this by restricting entity expansion, limiting document size or nesting, or refusing to process document type definitions that declare entities when they are not needed. Developers also need to check the parser’s configuration rather than assuming that a small upload is cheap to process.
That is the trick behind the attack: the server is not fooled by a complicated-looking file. It is overwhelmed by faithfully carrying out a tiny set of instructions.
