vetkit.java.xxe.unhardened-parser

An XML parser is created and used without disabling DTDs/external entities (XXE).

Last updated: 2026-11-01

Suite: Security

java

An XML parser is created and used without disabling DTDs/external entities (XXE).

Category: SECURITY · Engine rule severity: WARNING

How to fix it

Disable DOCTYPE declarations on the factory (e.g. setFeature("http://apache.org/xml/features/disallow-doctype-decl", true), or XMLInputFactory.SUPPORT_DTD=false) before creating the parser.

References

https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

Source: packages/engine/rules/sast/java.yml.

Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.