We previously covered the anatomy of an XXE bug and how nested entity expansion can lead to exponential resource use. We've also covered how valid XML structures can be injected through RESTful APIs so that malicious tags are recreated in the XML formatting (we used a fictional case of an XML-like DB, but the analysis holds for any server-side XML processing layer).
You can see how these two dynamics complement one another—if you have discovered a valid XML injection vector, that gives you the delivery mechanism with which to define and execute your XXE validation.
