Skip to content

XML lint

Lint an XML document (or paste it in) for well-formedness, with line and column, and for the XXE shapes (external entities, entity expansion) that downstream pa…

XMLlintXXE

Upload

Files (0–1)
One XML document, up to 4 MB, or paste it below. Nothing is transformed, fetched, or resolved; you get a lint report.
Paste an XML document instead of uploading a file. The same protections apply: no external resource is ever fetched or resolved, and the same report is produced.
Questions people ask
Will it fetch entities or DTDs?
No. The parser is configured so it has *no* way to fetch: the external-entity fetch handler is intentionally not registered, so the document can declare external entities (we flag that) but the tool will never resolve them to a file or a URL. The DTD is not downloaded; the internal subset, if present, is parsed locally by the same no-fetch parser. The tool's output therefore never contains the contents of any referenced external resource.
What is an XXE shape?
XML External Entity (XXE) is the attacker shape where a document declares an entity that points at a local file, an internal URL, or a DNS endpoint, and a naive parser resolves it, leaking files or opening SSRF channels. This tool does not resolve entities, so it cannot be XXE'd; instead it reports the shape: any external entity declaration, any DOCTYPE with an external subset, is listed in the findings so you know what would happen if another parser saw the same document.
What about entity expansion (billion laughs)?
The classic internal-entities explosion is bounded differently here: we let expat expand internal entities (the safe, local kind), and we cap the total expanded character count at 1 MiB. A document that tries to grow past that cap is reported (with a stable error finding in the report) rather than parsed to exhaustion. A wire document already costs at most 4 MB at the byte cap.
Does a document that is not well-formed make the job fail?
No. A malformed document is the *answer*, not the accident: the job completes and the report carries the parse error with expat's line and column. The job only fails on processor faults: no input, an unreadable input, or a document past the 4 MB cap.
Do you keep my file?
No. The document is read in an isolated job, the report is generated, and the upload is removed as soon as that finishes. Your report stays available for about 10 minutes, then it is automatically deleted too.