# Disable XML external entity (XXE) processing

**URL:** <https://community.sonarsource.com/t/disable-xml-external-entity-xxe-processing/17840>\
**Category:** SonarQube Server / Community Build\
**Tags:** java\
**Created:** [December 16, 2019, 2:33pm UTC](https://community.sonarsource.com/t/disable-xml-external-entity-xxe-processing/17840 "2019-12-16T14:33:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aehanno](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@aehanno](https://community.sonarsource.com/u/aehanno)\
**Post date:** [December 16, 2019, 2:33pm UTC](https://community.sonarsource.com/t/disable-xml-external-entity-xxe-processing/17840/1 "2019-12-16T14:33:23Z")

</div>

I have a vulnerability and I try to fix it like that :

```auto
DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
documentBuilderFactory.setProperty(DocumentBuilderFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
documentBuilderFactory.setProperty(DocumentBuilderFactory.SUPPORT_DTD, Boolean.FALSE); 

try {
	String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
	documentBuilderFactory.setFeature(FEATURE, true);

	FEATURE = "http://xml.org/sax/features/external-general-entities";
	documentBuilderFactory.setFeature(FEATURE, false);
  
	FEATURE = "http://xml.org/sax/features/external-parameter-entities";
	documentBuilderFactory.setFeature(FEATURE, false);

	FEATURE = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
	documentBuilderFactory.setFeature(FEATURE, false);
} catch (ParserConfigurationException e) {
	throw new RuntimeException("failed to instanciate documentBuilderFactory", e);
}

documentBuilderFactory.setXIncludeAware(false);
documentBuilderFactory.setExpandEntityReferences(false);

return documentBuilderFactory;

```

As follow indication in sonarQube

But it doesn’t know “IS\_SUPPORTING\_EXTERNAL\_ENTITIES” and " SUPPORT\_DTD" for DocumentBuilderFactory.

How I can fix this vulnaribilty in sonarQube ?  
Thanks

---

<div class="post-metadata">

**Author:** ![Quentin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/quentin/32/74716_2.png) [@Quentin](https://community.sonarsource.com/u/Quentin)\
**Post date:** [May 25, 2020, 3:20pm UTC](https://community.sonarsource.com/t/disable-xml-external-entity-xxe-processing/17840/3 "2020-05-25T15:20:06Z")

</div>

I just stumble into this topic, I know it’s an old one, but I want to add that we reworked completely this rule, both the description and the implementation. I invite anybody facing issues with this rule to test with a version of the Java Analyzer (\>= 6.2), and read the [latest description](https://rules.sonarsource.com/java/RSPEC-2755).

If something is still not clear, feel free to get back to us with more information on what needs clarification.

Best,  
Quentin

---

<div class="post-metadata">

**Author:** ![Quentin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/quentin/32/74716_2.png) [@Quentin](https://community.sonarsource.com/u/Quentin)\
**Post date:** [November 13, 2020, 9:42am UTC](https://community.sonarsource.com/t/disable-xml-external-entity-xxe-processing/17840/5 "2020-11-13T09:42:04Z")

</div>