{"record":{"id":"19489e3f82793efa","repo":"pentaho/pentaho-kettle","slug":"xsdvalidator-exception-disalloweddoctype","errorCode":null,"errorMessage":"XsdValidator.Exception.DisallowedDocType","messagePattern":"XsdValidator\\.Exception\\.DisallowedDocType","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"plugins/xml/core/src/main/java/org/pentaho/di/trans/steps/xsdvalidator/XsdValidator.java","lineNumber":242,"sourceCode":"          // ---Some documents specify the schema they expect to be validated against,\n          // ---typically using xsi:noNamespaceSchemaLocation and/or xsi:schemaLocation attributes\n          // ---Schema SchematXSD = factoryXSDValidator.newSchema();\n          SchematXSD = factoryXSDValidator.newSchema();\n        }\n\n        // Create XSDValidator\n        Validator xsdValidator = SchematXSD.newValidator();\n\n        // Prevent against XML Entity Expansion (XEE) attacks.\n        // https://www.owasp.org/index.php/XML_Security_Cheat_Sheet#XML_Entity_Expansion\n        if ( !meta.isAllowExternalEntities() ) {\n          xsdValidator.setFeature( \"http://apache.org/xml/features/disallow-doctype-decl\", true );\n          xsdValidator.setFeature( \"http://xml.org/sax/features/external-general-entities\", false );\n          xsdValidator.setFeature( \"http://xml.org/sax/features/external-parameter-entities\", false );\n          xsdValidator.setProperty( \"http://apache.org/xml/properties/internal/entity-resolver\",\n            (XMLEntityResolver) xmlResourceIdentifier -> {\n              String message = BaseMessages.getString( PKG, \"XsdValidator.Exception.DisallowedDocType\" );\n              throw new IOException( message );\n            } );\n        }\n\n        // Validate XML / XSD\n        xsdValidator.validate( sourceXML );\n\n        isvalid = true;\n\n      } catch ( SAXException ex ) {\n        validationmsg = ex.getMessage();\n      } catch ( IOException ex ) {\n        validationmsg = ex.getMessage();\n      } finally {\n        try {\n          if ( xsdfile != null ) {\n            xsdfile.close();\n          }\n        } catch ( IOException e ) {","sourceCodeStart":224,"sourceCodeEnd":260,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/xml/core/src/main/java/org/pentaho/di/trans/steps/xsdvalidator/XsdValidator.java#L224-L260","documentation":"An IOException named after the 'DisallowedDocType' message, thrown from the custom XMLEntityResolver when the parser encounters a DOCTYPE declaration. The step hardens the validator by disabling doctype/external entities (XXE protection) and rejects any document with a DTD.","triggerScenarios":"xsdValidator.validate(sourceXML) parses XML that contains a <!DOCTYPE ...> declaration; the disallow-doctype-decl feature or entity resolver fires and throws IOException(message).","commonSituations":"Validating legacy XML generated with DTDs; third-party feeds embedding <!DOCTYPE>; documents copied from templates with doctype headers while the step enforces XSD-only validation.","solutions":["Remove the DOCTYPE/DTD declaration from the input XML (strip it upstream with Replace in string / JavaScript / modified Java step)","Regenerate the source XML without DTD references","If DTD validation is truly needed, do not use this hardened validator path (e.g. pre-validate in a User Defined Java Class)","If you control the code, catch IOException and route the row to error handling instead of failing"],"exampleFix":"// before\n<?xml version=\"1.0\"?><!DOCTYPE order SYSTEM \"order.dtd\"><order>...</order>\n// after\n<?xml version=\"1.0\"?><order>...</order>","handlingStrategy":"try-catch","validationCode":"String head = xml.substring(0, Math.min(xml.length(), 1024));\nif (head.contains(\"<!DOCTYPE\")) { throw new IllegalStateException(\"DOCTYPE not allowed in XML to validate\"); }","typeGuard":null,"tryCatchPattern":"try { xsdValidator.validate(sourceXML); } catch (IOException e) { if (String.valueOf(e.getMessage()).contains(\"DisallowedDocType\")) { routeToErrorRow(row, \"Document contains a DOCTYPE\"); } else { throw e; } }","preventionTips":["Strip DOCTYPE/Dtd declarations in a preprocessing step","Generate source XML without DTD references","Keep XXE-protection features enabled; educate upstream producers"],"tags":["kettle","xsd-validator","doctype","xxe","xml-security"],"backgroundTag":"schema-validation-failed","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}