🔵Info

Java XXE Prevention

Comprehensive guide to preventing XXE vulnerabilities in Java applications using secure XML parser configurations across different libraries.

Overview

Java applications are particularly susceptible to XXE attacks because many XML parsers have external entity processing enabled by default. This guide covers secure configuration for the most common Java XML parsing libraries:

DocumentBuilderFactory (DOM)
SAXParserFactory (SAX)
XMLInputFactory (StAX)
TransformerFactory (XSLT)
SchemaFactory
XMLReader

The key principle: Explicitly disable all dangerous features before parsing any untrusted XML.

DocumentBuilderFactory (DOM Parsing)

DocumentBuilderFactory is the most common way to parse XML in Java. Here's the secure configuration:

Secure DocumentBuilderFactory

JavaSecureDocumentBuilder.java✓ Secure
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;

public class SecureDocumentBuilder {
    public static DocumentBuilder createSecureBuilder() 
            throws ParserConfigurationException {
        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        
        // This is the PRIMARY defense. If DTDs (doctypes) are disallowed,
        // almost all XXE attacks are prevented
        String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
        dbf.setFeature(FEATURE, true);
        
        // If you can't completely disable DOCTYPE, then at least do these:
        // Disable external general entities
        dbf.setFeature(
            "http://xml.org/sax/features/external-general-entities", 
            false
        );
        
        // Disable external parameter entities
        dbf.setFeature(
            "http://xml.org/sax/features/external-parameter-entities", 
            false
        );
        
        // Disable external DTDs
        dbf.setFeature(
            "http://apache.org/xml/features/nonvalidating/load-external-dtd",
            false
        );
        
        // Disable XInclude processing
        dbf.setXIncludeAware(false);
        
        // Disable entity expansion
        dbf.setExpandEntityReferences(false);
        
        return dbf.newDocumentBuilder();
    }
}

SAXParserFactory (SAX Parsing)

SAX parsers are event-driven and also need secure configuration:

Secure SAXParserFactory

JavaSecureSAXParser.java✓ Secure
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
import javax.xml.parsers.ParserConfigurationException;
import org.xml.sax.SAXException;

public class SecureSAXParser {
    public static SAXParser createSecureParser() 
            throws ParserConfigurationException, SAXException {
        SAXParserFactory spf = SAXParserFactory.newInstance();
        
        // Disable DOCTYPE declarations
        spf.setFeature(
            "http://apache.org/xml/features/disallow-doctype-decl", 
            true
        );
        
        // Disable external general entities
        spf.setFeature(
            "http://xml.org/sax/features/external-general-entities", 
            false
        );
        
        // Disable external parameter entities
        spf.setFeature(
            "http://xml.org/sax/features/external-parameter-entities", 
            false
        );
        
        // Disable loading external DTD
        spf.setFeature(
            "http://apache.org/xml/features/nonvalidating/load-external-dtd", 
            false
        );
        
        return spf.newSAXParser();
    }
}

XMLInputFactory (StAX Parsing)

StAX (Streaming API for XML) also requires secure configuration:

Secure XMLInputFactory

JavaSecureStAXParser.java✓ Secure
import javax.xml.stream.XMLInputFactory;
import javax.xml.stream.XMLStreamException;

public class SecureStAXParser {
    public static XMLInputFactory createSecureFactory() {
        XMLInputFactory xif = XMLInputFactory.newFactory();
        
        // Disable DTDs entirely
        xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);
        
        // Disable external entities
        xif.setProperty(
            XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, 
            false
        );
        
        return xif;
    }
}

TransformerFactory (XSLT)

XSLT transformers can also be exploited for XXE attacks:

Secure TransformerFactory

JavaSecureTransformer.java✓ Secure
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.TransformerConfigurationException;
import javax.xml.XMLConstants;

public class SecureTransformer {
    public static TransformerFactory createSecureFactory() 
            throws TransformerConfigurationException {
        TransformerFactory tf = TransformerFactory.newInstance();
        
        // Disable access to external DTDs and stylesheets
        tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
        tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
        
        // For older Java versions, use:
        tf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        
        return tf;
    }
}

SchemaFactory (XML Schema)

Schema validation can also be vulnerable:

Secure SchemaFactory

JavaSecureSchema.java✓ Secure
import javax.xml.validation.SchemaFactory;
import javax.xml.XMLConstants;
import org.xml.sax.SAXException;

public class SecureSchema {
    public static SchemaFactory createSecureFactory() 
            throws SAXException {
        SchemaFactory sf = SchemaFactory.newInstance(
            XMLConstants.W3C_XML_SCHEMA_NS_URI
        );
        
        // Disable access to external DTDs and schemas
        sf.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
        sf.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
        
        return sf;
    }
}

XMLReader

XMLReader also needs secure configuration:

Secure XMLReader

JavaSecureXMLReader.java✓ Secure
import org.xml.sax.XMLReader;
import org.xml.sax.SAXException;
import javax.xml.parsers.SAXParserFactory;
import javax.xml.parsers.ParserConfigurationException;

public class SecureXMLReader {
    public static XMLReader createSecureReader() 
            throws SAXException, ParserConfigurationException {
        SAXParserFactory spf = SAXParserFactory.newInstance();
        
        spf.setFeature(
            "http://apache.org/xml/features/disallow-doctype-decl", 
            true
        );
        spf.setFeature(
            "http://xml.org/sax/features/external-general-entities", 
            false
        );
        spf.setFeature(
            "http://xml.org/sax/features/external-parameter-entities", 
            false
        );
        
        XMLReader reader = spf.newSAXParser().getXMLReader();
        return reader;
    }
}

Complete Secure Example

Here's a complete example showing secure XML parsing in a real application:

Production-Ready Secure Parser

JavaProductionXMLParser.java✓ Secure
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import org.w3c.dom.Document;
import java.io.InputStream;
import java.util.logging.Logger;

public class ProductionXMLParser {
    private static final Logger LOGGER = 
        Logger.getLogger(ProductionXMLParser.class.getName());
    
    private final DocumentBuilder builder;
    
    public ProductionXMLParser() throws Exception {
        this.builder = createSecureBuilder();
    }
    
    private DocumentBuilder createSecureBuilder() throws Exception {
        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        
        try {
            // PRIMARY DEFENSE: Disable DOCTYPE
            dbf.setFeature(
                "http://apache.org/xml/features/disallow-doctype-decl", 
                true
            );
            
            // SECONDARY DEFENSES (in case DOCTYPE can't be disabled)
            dbf.setFeature(
                "http://xml.org/sax/features/external-general-entities", 
                false
            );
            dbf.setFeature(
                "http://xml.org/sax/features/external-parameter-entities", 
                false
            );
            dbf.setFeature(
                "http://apache.org/xml/features/nonvalidating/load-external-dtd",
                false
            );
            
            // Additional security settings
            dbf.setXIncludeAware(false);
            dbf.setExpandEntityReferences(false);
            
            LOGGER.info("Secure XML parser initialized successfully");
            
        } catch (Exception e) {
            LOGGER.severe("Failed to configure secure XML parser: " 
                + e.getMessage());
            throw new Exception(
                "Could not create secure XML parser", e
            );
        }
        
        return dbf.newDocumentBuilder();
    }
    
    public Document parseXML(InputStream xmlInput) throws Exception {
        try {
            return builder.parse(xmlInput);
        } catch (Exception e) {
            LOGGER.severe("XML parsing failed: " + e.getMessage());
            throw new Exception("Invalid XML input", e);
        }
    }
}

Testing Your Configuration

Always test that your configuration actually prevents XXE attacks:

Unit Test for XXE Prevention

JavaXMLParserTest.java
import org.junit.Test;
import static org.junit.Assert.*;

public class XMLParserTest {
    
    @Test(expected = Exception.class)
    public void testXXEIsBlocked() throws Exception {
        // This XXE payload should be rejected
        String xxePayload = 
            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" +
            "<!DOCTYPE foo [" +
            "  <!ENTITY xxe SYSTEM \"file:///etc/passwd\">" +
            "]>" +
            "<root>" +
            "  <data>&xxe;</data>" +
            "</root>";
        
        ProductionXMLParser parser = new ProductionXMLParser();
        
        // This should throw an exception due to DOCTYPE
        parser.parseXML(
            new ByteArrayInputStream(xxePayload.getBytes())
        );
        
        fail("XXE payload was not blocked!");
    }
    
    @Test
    public void testValidXMLIsParsed() throws Exception {
        String validXml = 
            "<?xml version=\"1.0\" encoding=\"UTF-8\"?>" +
            "<root>" +
            "  <data>Hello World</data>" +
            "</root>";
        
        ProductionXMLParser parser = new ProductionXMLParser();
        Document doc = parser.parseXML(
            new ByteArrayInputStream(validXml.getBytes())
        );
        
        assertNotNull(doc);
    }
}

Common Mistakes to Avoid

Mistake 1: Partial Configuration ❌ Only disabling one feature ✓ Disable ALL dangerous features

Mistake 2: Wrong Feature Names ❌ Using incorrect feature URIs ✓ Copy exact feature names from this guide

Mistake 3: Not Testing ❌ Assuming configuration works without testing ✓ Write unit tests with XXE payloads

Mistake 4: Catching and Ignoring Exceptions ❌ try { setFeature(...) } catch (Exception e) {} ✓ Let configuration failures propagate

Mistake 5: Using Vulnerable Libraries ❌ Using outdated XML libraries ✓ Keep dependencies up to date

Quick Reference Summary

For DocumentBuilderFactory:

dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

For SAXParserFactory:

spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);

For XMLInputFactory:

xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);
xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);

For TransformerFactory:

tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
tf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

Remember: The single most effective defense is disallow-doctype-decl.