JFrancisco541343 (Community Member) asked a question.
What are the necessary adjustments to the SAXBuilder to prevent XML eXternal Entity (XXE) attacks?
I've extended the SAXBuilder and made the necessary adjustments, but Veracode is looking for something else as its usage is still getting flagged.
public SecureSAXBuilder() {
super();
// Configure SAXBuilder to prevent XXE
this.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
this.setFeature("http://xml.org/sax/features/external-general-entities", false);
this.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
this.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
}
.png){kind=logo}
Hello ,
I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, and click on your user avatar.
2. Select Contact Support from the drop-down menu.Open a case with Support, and the engineer will help to resolve the issue.
Regards,
Pranita
Veracode Inc.