xxe

[QiAnXinCodeSafe]

The xml external entity is not disabled when parsing the xml string. When analyzing malicious apk or app, it may cause xml external entity injection.

[borisf]

Any suggestions how to fix

[QiAnXinCodeSafe]

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);