S2755: XML parsers should not be vulnerable to XXE attacks

[jveldemann (Janno Veldemann)]

• SonarQube 9.1

SchemaFactory factory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");

Suggestion under “Why this is an issue”:

SchemaFactory factory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI);
// to be compliant, completely disable DOCTYPE declaration:
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
// or prohibit the use of all protocols by external entities:
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");

[alban.auzeill]

I aligned the documentation with the implementation of the rule by replacing setAttribute with setProperty for the javax.xml.validation.SchemaFactory in this PR.
Thanks, for your feedback.
Alban