Hi @NSHARMA105946 (Community Member)​ ,

Veracode Static Analysis will report CWE 611 XXE when it detects an XML parser and does not detect the remediation techniques as documented in the OWASP XXE Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html .

The concern being that an attacker could insert their own elements in XML documents and use it to for example exfiltrate system data. You can read more on XXE here: https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing .

For the 'Transformer' the recommended solution is to disable access to external DTD and Stylesheets.

If this breaks your functionality you may be relying on an external DTD or Stylesheet for your functionality.

If you rely on external entities you may want to consider implementing a custom EntityResolver as documented here: https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#no-op-entityresolver example of how to implement this with a Transformer here: https://stackoverflow.com/a/55323922/4512 . An/or you may want to ensure that the XML documents originate from a trusted source.

After this you can document this in a mitigation proposal and contact your security team to request approval, you can learn more on how to propose a mitigation here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ

Thank you,

Boy Baukema