Verify XML parsers disable external entities

Jun 26, 2026 · 1 min read

Default parser configurations in many languages resolve external entities. Find parser factories and confirm the hardening flags are set.

bash

grep -rEn "DocumentBuilderFactory|SAXParser|XMLReader|etree|lxml|XmlReader|libxml" --include=*.{java,py,cs} .

Safe Java configuration disables DTDs.

java

dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setExpandEntityReferences(false);

Pro note: secure processing alone does not stop all XXE; the disallow-doctype feature is the strong control. In Python, use defusedxml. Remember SVG, DOCX, and SOAP endpoints all parse XML and often use a second, unhardened parser.