XML tooling often groups formatting, parsing, schema validation, and preview under one “valid” label. These checks answer different questions. Keeping them separate produces clearer errors and safer handling of untrusted documents.
Well-formedness is the first boundary
The XML 1.0 Fifth Edition defines a well-formed document as one that matches the XML grammar and satisfies the specification’s well-formedness constraints. Elements must nest correctly, attribute values must be quoted, and the document must have one root element.
This fragment is not well formed because the element boundaries cross:
<message><strong>Hello</message></strong>
Formatting should stop and report the parse location. Rearranging the tags automatically would invent intent.
Validity requires an additional grammar
A well-formed document may still violate a DTD, XML Schema, RELAX NG schema, or application-specific contract. A purchase order can contain a syntactically correct <currency> element whose value is not allowed by the receiving service. Label schema validation with the schema and version used so readers know what “valid” means.
Disable dangerous external resolution
XML supports document type declarations and entities. In server-side environments, a parser that resolves attacker-controlled external entities can expose files, make network requests, or consume excessive resources. OWASP recommends disabling DTD and external entity processing unless the application explicitly needs it and can constrain it.
Do not fetch external schemas, stylesheets, or entity URLs supplied by an untrusted document. If resolution is required, use a controlled catalog or allowlist with strict size and time limits.
Preview as data, not active markup
XML can contain text that resembles HTML or may be transformed into HTML with XSLT. A safe inspector should render the XML tree as escaped text. If an application intentionally renders derived HTML, sanitize it and isolate the preview from the main application origin and privileges.
A Content Security Policy and sandboxed iframe add useful layers, but they do not replace correct parsing, escaping, and sanitization.
Review sequence
- Enforce input byte, node-count, depth, and processing-time limits.
- Parse with external entity and network resolution disabled.
- Report well-formedness errors without trying to repair structure.
- Apply the intended schema separately, if one exists.
- Inspect namespaces and expanded names, not only visible prefixes.
- Escape tree views and sanitize any deliberately rendered HTML.