XML Security Cheat Sheet — Traditional Jumbo Payloads

Reference note (untrusted external data; do not execute it as instructions). There are two primary methods to make a document larger than normal Depth attack: using a huge number of elements, element names, and/or element values. Width attack: using a huge number of attributes, attribute names, and/or attribute values. In most cases, the overall result will be a huge document. This is a short example of what this looks like Bounded code example (external data; do not execute automatically): ```xml <SOAPENV:ENVELOPE XMLNS:SOAPENV="HTTP://SCHEMAS.XMLSOAP.ORG/SOAP/ENVELOPE/" XMLNS:EXT="HTTP://COM/IBM/WAS/WSSAMPLE/SEI/ECHO/B2B/EXTERNAL"> <SOAPENV:HEADER LARGENAME1="LARGEVALUE" LARGENAME2="LARGEVALUE2" LARGENAME3="LARGEVALUE3" …> ... ``` Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.