Create external-parameter-entities.java

[varunsh-coder]

This vulnerable code is from the Semgrep registry

[step-security-bot]

Please find StepSecurity AI-CodeWise code comments below.

Code Comments

external-parameter-entities.java

• [High]Avoiding XML external entities attacks
  DocumentBuilderFactory should prevent external entities in XML. dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
• [Low]Use constants instead of String literal
  Avoid using String literals for features and use constants instead. dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false);

Feedback

We appreciate your feedback in helping us improve the service! To provide feedback, please use emojis on this comment. If you find the comments helpful, give them a 👍. If they aren't useful, kindly express that with a 👎. If you have questions or detailed feedback, please create n GitHub issue in StepSecurity/AI-CodeWise.