XXE detection

An XML external entity makes the reader fetch a local file or a URL.

Why does it matter?

A slicer that follows it can leak files or send requests you never meant. This is CWE-611.

What does preslice check?

Every text file in the archive, XML or not and UTF-16 included, for a <!DOCTYPE or <!ENTITY declaration.

What does a fail mean?

The file declares a document type or an entity. No normal slicer writes one, and a declaration is what an external entity needs. Treat the file with care.

Which apps did it work on?

Repetier-Host leaked local files through external parameter entities in the 2023 study Security Analysis of the 3MF Data Format (RAID 2023). Repetier-Host and lib3mf fixed what the study found.

Are current slicers exposed?

No case is known. Bambu Studio, OrcaSlicer and PrusaSlicer read 3MF XML with expat, which never fetches an outside file unless the program asks it to. Bambu Studio and OrcaSlicer clear that hook outright (bbs_3mf.cpp). Cura reads geometry with pugixml, which does not load external entities.

What do I do when the check fails?

Do not open the file in a slicer you have not updated. Open the named file in the Raw tab and read the <!DOCTYPE block: a SYSTEM or PUBLIC address there is what the file wants a reader to fetch. Delete the file and tell whoever shared it.