XML external entity (ARCH4105)

Key java.security.xxe · Severity error · Category security · CWE CWE-611

An XML parser configured to resolve DTDs or external entities is exposed to XXE injection, which can lead to local file read, SSRF, and denial of service.

Incorrect

DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
Document doc = f.newDocumentBuilder().parse(input);

Correct

DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
f.setXIncludeAware(false);
f.setExpandEntityReferences(false);
Document doc = f.newDocumentBuilder().parse(input);

Fix

Disable DOCTYPE declarations and external entity resolution on the parser.