Zennoxa Shield
Rules / Java
SHIELD-JAVA-007

XXE via SAXParserFactory

highJavaCWE-611CVSS 8.2

What it detects

SAXParserFactory created without disabling external entities is vulnerable to XXE.

How to fix

Disable external entities and DTDs via setFeature before parsing untrusted XML.

Vulnerable — Shield flags thisFeedParser.java
import javax.xml.parsers.*;
import org.xml.sax.helpers.DefaultHandler;
import java.io.InputStream;

public class FeedParser {
    public void parse(InputStream untrustedXml, DefaultHandler handler) throws Exception {
        SAXParserFactory factory = SAXParserFactory.newInstance();
        SAXParser parser = factory.newSAXParser();
        parser.parse(untrustedXml, handler);
    }
}
Fixed — scans cleanFeedParser.java
import javax.xml.parsers.*;
import org.xml.sax.helpers.DefaultHandler;
import java.io.InputStream;

public class FeedParser {
    public void parse(InputStream untrustedXml, DefaultHandler handler) throws Exception {
        SAXParserFactory factory = SAXParserFactory.newInstance();
        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        SAXParser parser = factory.newSAXParser();
        parser.parse(untrustedXml, handler);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-007, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-007: XXE via SAXParserFactory — Zennoxa Shield