Impact of XXE :


Mitigation:

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("<http://apache.org/xml/features/disallow-doctype-decl>", true);
dbf.setFeature("<http://xml.org/sax/features/external-general-entities>", false);
dbf.setFeature("<http://xml.org/sax/features/external-parameter-entities>", false);
dbf.setFeature("<http://apache.org/xml/features/nonvalidating/load-external-dtd>", false);
dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);
DocumentBuilder db = dbf.newDocumentBuilder();