{"record":{"id":"9279b2f2016d950c","repo":"OpenFeign/feign","slug":"e-tostring","errorCode":null,"errorMessage":"${e.toString()}","messagePattern":"\\$\\{e\\.toString\\(\\)\\}","errorType":"exception","errorClass":"DecodeException","httpStatus":null,"severity":"error","filePath":"jaxb-jakarta/src/main/java/feign/jaxb/JAXBDecoder.java","lineNumber":97,"sourceCode":"\n    try {\n      SAXParserFactory saxParserFactory = SAXParserFactory.newInstance();\n      /* Explicitly control sax configuration to prevent XXE attacks */\n      saxParserFactory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n      saxParserFactory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n      saxParserFactory.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", false);\n      saxParserFactory.setFeature(\n          \"http://apache.org/xml/features/nonvalidating/load-external-dtd\", false);\n      saxParserFactory.setNamespaceAware(namespaceAware);\n\n      return jaxbContextFactory\n          .createUnmarshaller((Class<?>) type)\n          .unmarshal(\n              new SAXSource(\n                  saxParserFactory.newSAXParser().getXMLReader(),\n                  new InputSource(response.body().asInputStream())));\n    } catch (JAXBException | ParserConfigurationException | SAXException e) {\n      throw new DecodeException(response.status(), e.toString(), response.request(), e);\n    } finally {\n      if (response.body() != null) {\n        response.body().close();\n      }\n    }\n  }\n\n  public static class Builder {\n    private boolean namespaceAware = true;\n    private JAXBContextFactory jaxbContextFactory;\n\n    /** Controls whether the underlying XML parser is namespace aware. Default is true. */\n    public Builder withNamespaceAware(boolean namespaceAware) {\n      this.namespaceAware = namespaceAware;\n      return this;\n    }\n\n    public Builder withJAXBContextFactory(JAXBContextFactory jaxbContextFactory) {","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/OpenFeign/feign/blob/e2a1e27560a1e68840c34f031afca88b36096e30/jaxb-jakarta/src/main/java/feign/jaxb/JAXBDecoder.java#L79-L115","documentation":"JAXBDecoder.decode catches JAXBException, ParserConfigurationException and SAXException while unmarshalling the response body via SAX and rethrows them as a Feign DecodeException whose message is e.toString(). It means XML parsing/unmarshalling of the HTTP response failed - typically malformed XML, a root element that does not match the target type, or a class not correctly mapped via JAXBContextFactory.","triggerScenarios":"decode() is invoked on a response whose body is not well-formed XML, or whose XML does not match the @XmlRootElement-annotated target type; also raised when SAX parser creation fails or the underlying input stream errors during unmarshal.","commonSituations":"Server returns an HTML error page instead of XML; response XML root element or namespaces don't match the declared return type; missing @XmlRootElement on the DTO causing JAXBException; response truncated by a proxy.","solutions":["Inspect e.getCause() in the DecodeException to see the actual JAXB/SAX error and fix the XML or the type mapping.","Verify the server returns well-formed XML matching the annotated return type (root element, namespaces).","Ensure target DTOs carry @XmlRootElement/@XmlElement annotations and are registered with the JAXBContextFactory.","Catch DecodeException in caller code and log status plus cause for diagnostics."],"exampleFix":"// before\nMyDto dto = api.get(); // throws DecodeException on bad XML\n// after\ntry {\n  MyDto dto = api.get();\n} catch (DecodeException e) {\n  logger.error(\"decode failed status=\" + e.status(), e.getCause());\n}","handlingStrategy":"try-catch","validationCode":"// before calling\nString ct = response.headers().getOrDefault(\"content-type\", \"\").toLowerCase();\nif (!ct.contains(\"xml\")) throw new IllegalStateException(\"endpoint did not return XML: \" + ct);","typeGuard":null,"tryCatchPattern":"try {\n  result = api.call();\n} catch (DecodeException e) {\n  Throwable c = e.getCause();\n  if (c instanceof SAXException || c instanceof JAXBException) {\n    // malformed XML or mapping mismatch; log and fall back\n  } else { throw e; }\n}","preventionTips":["Validate endpoints return well-formed XML with an application/xml or text/xml content type.","Keep DTO @XmlRootElement/@XmlElement annotations in sync with the server schema, including namespaces.","Test decode paths with contract tests using sample payloads.","Always inspect DecodeException.getCause(), not just its message."],"tags":["jaxb","decode","xml-parsing"],"backgroundTag":"xml-unmarshal-failed","analyzedSha":"e2a1e27560a1e68840c34f031afca88b36096e30","analyzedAt":"2026-09-10T12:37:37.238Z","contentChangedAt":"2026-09-10T12:37:37.238Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}