XML External Entity (ARCH8105)
Ce contenu n’est pas encore disponible dans votre langue.
Key kotlin.security.xxe · Severity error · Category security · CWE CWE-611
Flags DocumentBuilderFactory / SAXParserFactory / XMLInputFactory / XmlPullParser used without disabling DTDs and external entities.
Incorrect
Section titled “Incorrect”val db = DocumentBuilderFactory.newInstance().newDocumentBuilder()Correct
Section titled “Correct”val f = DocumentBuilderFactory.newInstance()f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)val db = f.newDocumentBuilder()Disable doctype declarations and external general / parameter entities before parsing.