JSON vs XML

XML External Entity (XXE) injection exploits XML's DTD (Document Type Definition) feature, which allows a document to define custom entities — including entities that reference external resources, such as a local file path or an internal network URL. A vulnerable XML parser that resolves external entities by default can be tricked into reading arbitrary local files or making unintended internal network requests, simply by processing a maliciously-crafted XML document. This class of vulnerability has appeared repeatedly across many real-world XML-processing systems and is well-documented in the OWASP Top Ten's historical entries.

A related attack, the 'XML Bomb' or 'Billion Laughs' attack, abuses XML's entity-expansion feature: a small document defines a handful of nested entities that each reference the previous one multiple times, causing exponential expansion when a parser naively resolves them — a tiny input document can expand to gigabytes in memory, exhausting server resources and causing a denial-of-service crash. (YAML has a closely related expansion-attack risk via its anchor/alias feature, covered in JSON vs YAML — both stem from the same underlying idea: a compact reference expanding recursively during parsing.)

JSON has no DTD equivalent and no entity-reference mechanism at all, which means it's structurally immune to both XXE and Billion-Laughs-style entity expansion — not because JSON parsers are more carefully written, but because the language features that make these attacks possible simply don't exist in JSON's grammar. Modern XML parsers mitigate these risks by disabling external entity resolution and DTD processing by default, but the fact that this required a deliberate parser-configuration fix, rather than being structurally impossible, is a genuine point in JSON's favor for any system processing untrusted XML input.

XML Schema (XSD), a mature W3C standard, provides rich, strict structural validation — data types, cardinality constraints, namespaces-aware validation — that's been battle-tested across two decades of enterprise deployments, particularly in financial, healthcare, and government systems that adopted XML and SOAP early.

JSON Schema (see the JSON Schema Generator and JSON Schema Validator) provides comparable structural validation for JSON documents, but with a simpler feature set and a shorter track record than XSD. For most modern API-validation use cases this simplicity is an advantage, not a limitation — but systems requiring XSD's more elaborate validation constructs (or that must interoperate with existing XSD-validated systems) don't have a fully equivalent option in the JSON world.