encoding/xml package. Unmarshal and Decoder.Decode() are sources. Can also be an XXE sink if xml.Decoder is used without disabling external entity processing.
.Unmarshal().NewDecoder().Unmarshal()SourceUnmarshal(data []byte, v any) error
Decodes XML into v. v becomes tainted. Potential XXE if data contains external entities.
1.NewDecoder()SinkNewDecoder(r io.Reader) *Decoder
Creates XML decoder. XXE risk when r is user-controlled and entity expansion not limited.
0| FQN | Field | |
|---|---|---|
| encoding/xml | fqns[0] |
Wrong FQN → 0 findings. Verify with: change fqns to garbage → must produce 0 results.
// standard library — no go.mod entry required
from codepathfinder.go_rule import GoEncodingXML