XML External Entity (ARCH8105)

Key kotlin.security.xxe · Severity error · Category security · CWE CWE-611

Flags DocumentBuilderFactory / SAXParserFactory / XMLInputFactory / XmlPullParser used without disabling DTDs and external entities.

Incorrect

val db = DocumentBuilderFactory.newInstance().newDocumentBuilder()

Correct

val f = DocumentBuilderFactory.newInstance()
f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
val db = f.newDocumentBuilder()

Fix

Disable doctype declarations and external general / parameter entities before parsing.