Hello

Veracode static report showing below highlighted line as vulnerable. Input (body) is a XML of type String. Sample java code uses JAXBContext to parse and XMLInputFactory follows OWASP recommendation to disable DTD. Could you please review and advise? Thanks

XMLInputFactory xmlInputFactory = XMLInputFactory.newFactory();

xmlInputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);

xmlInputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);

final XMLStreamReader xmlStreamReader = xmlInputFactory.createXMLStreamReader(new StringReader(body));

JAXBContext jaxbContext = JAXBContext.newInstance(OrderResponse.class);

Unmarshaller jaxbUnmarshaller = jaxbContext.createUnmarshaller();

return (OrderResponse) jaxbUnmarshaller.unmarshal(xmlStreamReader);