Disable XML external entity (XXE) processing Issue

[jaikishore.polepalli (Jai Polepalli)]

Hi there,

We are using SonarQube version 7.9.2 to perform code analysis. I need some help on fixing the “Disable XML external entity (XXE) processing” Issue. The “DocumentBuilderFactory” class which is being used for XML parsing - SonarQube reported the “Disable XML external entity (XXE) processing” issue. Made code changes as suggested by SQ but still the issue persists.

PFB code screenshot. Can someone help with what is wrong in my code?

[eric.therond]

Hello @jaikishore.polepalli and welcome to the community!

XXE rule for Java has been improved recently (see this announcement):

@Alexandre_Gigleux

These features are already available on SonarCloud , and will be included in SonarQube 8.3. If you can’t wait, you can already install the v6.2 of the Java analyzer from the Marketplace.

If you are upgrading to take advantage of these new features, let us know if that resolves your problem, if you cannot upgrade, I suggest closing this issue as “False Positive”.

Eric