XML parsers Denial of Service attacks target XML parsers, which are software components responsible for parsing and interpreting XML documents.

## Why is this an issue?

XML files are complex data structures. When a malicious user is able to submit an XML file, it triggers complex processing that may overwhelm the parser. Most of the time, those complex processing are enabled by default, and XML parsers do not take preventive measures against Denial of Service attacks.

### What is the potential impact?

When an attacker successfully exploits the vulnerability, it can lead to a Denial of Service (DoS) condition.

### System Unavailability

Affected system becomes unresponsive or crashes, rendering it unavailable to legitimate users. This can have severe consequences, especially for critical systems that rely on continuous availability, such as web servers, APIs, or network services.

### Amplification Attacks

In some cases, XML parsers Denial of Service attacks can be used as a part of larger-scale amplification attacks. By leveraging the vulnerability, attackers can generate a disproportionately large response from the targeted system, amplifying the impact of their attack. This can result in overwhelming network bandwidth and causing widespread disruption.

## How to fix it in Java SE

### Code examples

#### Noncompliant code example

    import javax.xml.parsers.DocumentBuilderFactory;

    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false); // Noncompliant

#### Compliant solution

    import javax.xml.parsers.DocumentBuilderFactory;

    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
    factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

## How to fix it in Dom4j

### Code examples

#### Noncompliant code example

    import org.dom4j.io.SAXReader;

    SAXReader xmlReader = new SAXReader();
    xmlReader.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false); // Noncompliant

#### Compliant solution

    import org.dom4j.io.SAXReader;

    SAXReader xmlReader = new SAXReader();
    xmlReader.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

## How to fix it in Jdom2

### Code examples

#### Noncompliant code example

    import org.jdom2.input.SAXBuilder;

    SAXBuilder builder = new SAXBuilder();
    builder.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false);  // Noncompliant

#### Compliant solution

    import org.jdom2.input.SAXBuilder;

    SAXBuilder builder = new SAXBuilder();
    builder.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

## Resources

### Documentation

- Java Documentation - DocumentBuilderFactory Class
- Java Documentation - SAXParserFactory Class
- Java Documentation - SchemaFactory Class
- Java Documentation - TransformerFactory Class
- Java Documentation - Java API for XML Processing (JAXP) Security Guide
- Dom4j Documentation - SAXReader Class
- Jdom2 Documentation - SAXBuilder class
- OWASP - XXE Prevention Cheat Sheet

### Standards

- OWASP - Top 10 2021 Category A5 - Security Misconfiguration
- OWASP - Top 10 2017 Category A4 - XML External Entities (XXE)
- CWE - CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
- STIG Viewer - Application Security and Development: V-222593 - XML-based applications must mitigate DoS attacks by using XML filters, parser options, or gateways.
- STIG Viewer - Application Security and Development: V-222667 - Protections against DoS attacks must be implemented.
- STIG Viewer - Application Security and Development: V-222608 - The application must not be vulnerable to XML-oriented attacks.