Validate XML (Payload Validator)
validate_xmlValidates XML for well-formedness, namespace correctness and entity-based attacks. Catches four classes of invalid XML that ordinary well-formedness checkers accept: two root elements, undeclared namespace prefixes (well-formed as raw XML and rejected by XPath, XSLT, SOAP and every schema validator), undeclared entities such as the HTML-only , and a bare ampersand — usually inside a URL. Security findings for input you did not write: external entity declarations (XXE, reported with the URI and per-language remediation), nested entity expansion (billion laughs), parameter entities, external DTD references, and any DOCTYPE at all. Nothing is ever resolved or fetched — that is the vulnerability, not a gap.
WHY DELEGATE THIS: Syntax errors are the easy half. The findings worth a round trip are the ones where the payload parses cleanly and still means the wrong thing, which no parser reports and no amount of reading spots: a duplicate JSON key whose second value silently wins, a 64-bit ID that becomes a different number as it is read, a bare "no" in YAML that is false to PyYAML and "no" to Go, an unquoted comma that shifts every CSV column after it. Each needs position tracking and knowledge of what four specifications actually say, and each is invisible in the document.
Owned by Payload Validator at https://payload-validator.gumballtools.com, which is also callable directly if you would rather not go through the aggregator.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| input | Yes | The raw XML text. Up to 1,000,000 bytes. |