Disabling external entities does not by itself protect a report processor from every resource-exhaustion input. A compressed attachment can expand before the XML parser starts, and deeply nested or oversized XML can consume resources without accessing an external entity. Treat decompression, XML interpretation and workload admission as separate defensive boundaries.
RFC 9990 explicitly identifies archive and XML resource-exhaustion risks. OWASP's XML guidance explains why parser-specific external-resource controls matter. The test design here is an operational recommendation to verify those boundaries in an isolated staging environment.
Define what must never happen
References: RFC 9990 §8.1.
The worker should not fetch attachment-selected network resources, read application secrets through XML resolution, write archive-supplied paths or consume unbounded CPU, memory or disk. Give it minimal filesystem access and no unnecessary network access. Use a disposable test environment with synthetic canaries rather than production secrets.
Set observable limits for compressed input, expanded output, parsing time, nesting, text length and simultaneous jobs. Record where each limit is enforced. A timeout around the final import cannot protect an earlier unbounded decompression step.
Check XML capabilities directly
Reference: OWASP XML external-entity prevention, General Guidance.
Configure the actual parser and any schema-validation or transformation layer. Disable unnecessary DTD processing, external entities, XInclude and external resource loading. Treat unsupported security settings as configuration failures. A safe parser setting can be undermined if a later validation stage fetches a schema chosen by the input. Review the whole processing chain, not only its first library call.
Use a tiny fixture containing an external reference to a controlled test sentinel. The expected behavior is rejection or safe non-resolution under the documented policy, with no sentinel access. Record network and file-access telemetry. Do not point test references at sensitive local files or external services you do not control.
Bound harmless expansion tests
References: RFC 9990 §8.1.
For decompression, use small synthetic content and intentionally low staging thresholds. For XML, use bounded nesting or internal expansion fixtures designed to trip similarly low limits. There is no need to create a genuinely enormous bomb to establish that a boundary is enforced.
Illustrative case: a test worker has a 256 KiB expanded-byte cap and a one-second processing deadline. A 300 KiB synthetic expanded stream should stop at the byte boundary. A separate tiny external-reference fixture should cause no lookup. Passing one case does not prove the other boundary works. The thresholds are illustrative, and actual memory and elapsed time must be measured rather than assumed.
Verify failure containment
For every rejected fixture, assert that no partial report records were committed, no unapproved output file appeared and the diagnostic contains a safe input reference and reason. Bound diagnostic size too, because copying the entire rejected document into logs creates another resource and privacy risk.
Submit a valid small report next. Check that queue processing recovers, temporary files are cleaned within the approved policy and replay does not create duplicate counts. Exercise concurrent arrivals within a safe test budget so aggregate worker limits are tested as well as per-file limits.
Make the test evidence repeatable
References: RFC 9990 §8.1, RFC 9990 §9.2.
Retain fixture hashes, parser and runtime versions, configuration, limits, expected outcomes and measured results. Repeat after dependency, parser, container or validation changes. If a test cannot observe external access or memory use, mark that part unverified rather than declaring the pipeline secure.
A rejection proves that a specific input encountered a specific boundary in the tested configuration. It does not prove every possible malicious document is harmless. Combine focused fixtures, reviewed configuration, isolation and monitoring, and maintain an owner for follow-up when any boundary fails.
The review package executes only a small bounded decompression demonstration and semantic models. External-reference, memory-isolation, concurrent-worker and actual database-containment tests described above remain acceptance requirements, not completed tests.