XXE - Separate guidelines (XMLReader/SaxParser/DocumentParser)

[h3xstream]

The remediation should be specific to each api. This would require to separate XMLReader/SaxParser/DocumentParser description.

References:

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
try {
    dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
} catch (ParserConfigurationException e) { //handle error }

~

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
try {
    dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
    dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
} catch (ParserConfigurationException e) { //handle error }

https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing

[h3xstream]

done