> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Saxbuilder xxe

<AccordionGroup>
  <Accordion title="saxbuilder-xxe">
    The application is using an XML parser that has not been safely configured. This might lead to XML External Entity (XXE) vulnerabilities when parsing user-controlled input. An attacker can include document type definitions (DTDs) which can interact with internal or external hosts. XXE can lead to other vulnerabilities, such as Local File Inclusion (LFI), Remote Code Execution (RCE), and Server-side request forgery (SSRF), depending on the application configuration. An attacker can also use DTDs to expand recursively, leading to a Denial-of-Service (DoS) attack, also known as a Billion Laughs Attack. The XML parser $PARSER is not securely configured. The current configuration allows for XXE attacks. It is our recommendation to secure this parser against XXE attacks by configuring $PARSER with `$PARSER.setFeature(http://apache.org/xml/features/disallow-doctype-decl, true)`. Alternatively, the following configurations also provide protection against XXE attacks. `$PARSER.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "")` `$PARSER.setFeature("http://xml.org/sax/features/external-general-entities", false)` `$PARSER.setExpandEntities(false)` It is also possible to use one of the constructor parameters that will result in a more secure parser by default: `new SAXBuilder(XMLReaders.DTDVALIDATING)` or `new SAXBuilder(XMLReaders.XSDVALIDATING)`. For more information, see: [Java XXE prevention](https://semgrep.dev/docs/cheat-sheets/java-xxe/)<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-611: Improper Restriction of XML External Entity Reference
    <br />- CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
    <br />**OWASP**: <br />- A04:2017 - XML External Entities (XXE)
    <br />- A05:2021 - Security Misconfiguration
  </Accordion>
</AccordionGroup>