- Analyzer
- textscan
- Category
- Injection
- Default severity
- HIGH
- CWE
- CWE-611
- Execution
- Passive
- Authentication
- Not required
- Applicability
- java
- Availability
- stable
What it detects
XML external entity (XXE): XML parser factory created without hardening: an injection check run by the textscan analyzer.
Evidence
The matching source path, line, and bounded code observation produced by the native rule.
Remediation
Disable DOCTYPE/external entities: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) (or XMLConstants.FEATURE_SECURE_PROCESSING). Prefer a parser that rejects external entities by default.
Limitations
This check is limited to the applicability and evidence delivered by textscan. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.
Related reference
Analyzer Registry · Findings and release decisions · Policy and confidence
Remediation guidance: Remediation and fix verification · Baselines and suppressions