4

I am trying to create an instance of DocumentBuilderFactory with FEATURE_SECURE_PROCESSING set to true. I keep getting ParserConfigurationException when I am trying to setFeature.

        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
        try{
            factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        }
        catch (ParserConfigurationException e){ //Always gets here
            e.printStackTrace();
        }
Phantômaxx
  • 37,901
  • 21
  • 84
  • 115
Volodymyr Prysiazhniuk
  • 1,897
  • 4
  • 22
  • 33
  • Is that an Android thing? The JRE requires it. At least it requires it now - a very old parser implementation may not support it. – Tom Hawtin - tackline Feb 09 '19 at 08:48
  • @TomHawtin-tackline, yes its Android. – Volodymyr Prysiazhniuk Feb 10 '19 at 21:55
  • Googling gives this SO other question https://stackoverflow.com/questions/33337995/android-dom-xml-parser-that-supports-feature-secure-processing . Looks like a rather poor show on Google's part. – Tom Hawtin - tackline Feb 13 '19 at 10:36
  • Not planning to use any 3-rd part library in my source code. After more investigation - it seems like Android's version of DBF is sort of stripped by Google and therefore they suggest to use "XMLConstants.FEATURE_SECURE_PROCESSING", not sure if secure processing is actually helps to avoid XXE attacks. The only documentation left by Google on this constant:`instructs the implementation to process XML securely. This may set limits on XML constructs to avoid conditions such as denial of service attacks.` https://developer.android.com/reference/javax/xml/XMLConstants#FEATURE_SECURE_PROCESSING – Volodymyr Prysiazhniuk Feb 14 '19 at 18:30

0 Answers0