{"record":{"id":"df68549dfe08ae2e","repo":"stanfordnlp/CoreNLP","slug":"e-df6854","errorCode":null,"errorMessage":"e","messagePattern":"e","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"src/edu/stanford/nlp/util/XMLUtils.java","lineNumber":53,"sourceCode":" */\npublic class XMLUtils  {\n\n  /** A logger for this class */\n  private static final Redwood.RedwoodChannels log = Redwood.channels(XMLUtils.class);\n\n  private XMLUtils() {} // only static methods\n\n  public static DocumentBuilderFactory safeDocumentBuilderFactory() {\n    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();\n    try {\n      dbf.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n      dbf.setFeature(\"http://apache.org/xml/features/nonvalidating/load-external-dtd\", false);\n      dbf.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n      dbf.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n      dbf.setFeature(\"http://apache.org/xml/features/dom/create-entity-ref-nodes\", false);\n      dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);\n    } catch (ParserConfigurationException e) {\n      log.warn(e);\n    }\n    return dbf;\n  }\n    \n\n  /**\n   * Returns the text content of all nodes in the given file with the given tag.\n   *\n   * @return List of String text contents of tags.\n   */\n  public static List<String> getTextContentFromTagsFromFile(File f, String tag) {\n    List<String> sents = Generics.newArrayList();\n    try {\n      sents = getTextContentFromTagsFromFileSAXException(f, tag);\n    } catch (SAXException e) {\n      log.warn(e);\n    }\n    return sents;","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/stanfordnlp/CoreNLP/blob/1b7edd19c4d0d7b1f13a2591425b9b60a0b1af7a/src/edu/stanford/nlp/util/XMLUtils.java#L35-L71","documentation":"XMLUtils.safeDocumentBuilderFactory() hardens a DocumentBuilderFactory by disabling external DTD/entity loading and enabling secure processing. Some JAXP implementations (or older ones) do not recognize these feature URIs and throw ParserConfigurationException from setFeature(); the code logs the exception ('e' - the stack trace) and returns the factory with whichever features did apply. Hardening may be partial, but XML processing continues.","triggerScenarios":"Calling XMLUtils.dbFactory()/safeDocumentBuilderFactory() on a JDK or Xerces version that does not support one of the feature URIs (e.g. http://apache.org/xml/features/dom/create-entity-ref-nodes or FEATURE_SECURE_PROCESSING), so setFeature throws ParserConfigurationException.","commonSituations":"Running on a minimal/older JDK JAXP implementation; embedding CoreNLP in a container with a stripped XML parser; using a non-Xerces DocumentBuilderFactory on the classpath.","solutions":["Run on a recent JDK whose built-in Xerces supports all secure-processing features","Add a current Xerces-J (xercesImpl) to the classpath for full feature support","Review the logged stack trace to see which feature was rejected and whether it matters for your threat model","If XXE protection is critical, verify the resulting factory behavior or set features yourself in a try/catch per feature"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// detect whether the JAXP impl supports secure features before relying on them\norg.w3c.dom.DOMImplementation di = org.w3c.dom.bootstrap.DOMImplementationRegistry\n    .newInstance().getDOMImplementation(\"XML 3.0\");\nString version = javax.xml.parsers.DocumentBuilderFactory.newInstance()\n    .getClass().getPackage().getImplementationVersion();\n// if version is old/minimal, add xercesImpl to the classpath","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run on a current JDK (the built-in Xerces supports all listed features)","Do not override the JAXP DocumentBuilderFactory with an older implementation","If XXE protection is essential, set each feature yourself in a per-feature try/catch and fail hard on rejection"],"tags":["java","xml","security","xxe","parser-config"],"backgroundTag":"unsupported-operation","analyzedSha":"1b7edd19c4d0d7b1f13a2591425b9b60a0b1af7a","analyzedAt":"2026-09-10T02:24:07.274Z","contentChangedAt":"2026-09-10T02:24:07.274Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}