pentaho/pentaho-kettle · error · IOException

XsdValidator.Exception.DisallowedDocType

Error message

XsdValidator.Exception.DisallowedDocType

What it means

An IOException named after the 'DisallowedDocType' message, thrown from the custom XMLEntityResolver when the parser encounters a DOCTYPE declaration. The step hardens the validator by disabling doctype/external entities (XXE protection) and rejects any document with a DTD.

Solutions

  1. Remove the DOCTYPE/DTD declaration from the input XML (strip it upstream with Replace in string / JavaScript / modified Java step)
  2. Regenerate the source XML without DTD references
  3. If DTD validation is truly needed, do not use this hardened validator path (e.g. pre-validate in a User Defined Java Class)
  4. If you control the code, catch IOException and route the row to error handling instead of failing

Example fix

// before
<?xml version="1.0"?><!DOCTYPE order SYSTEM "order.dtd"><order>...</order>
// after
<?xml version="1.0"?><order>...</order>
Defensive patterns

Strategy: try-catch

Validate before calling

String head = xml.substring(0, Math.min(xml.length(), 1024));
if (head.contains("<!DOCTYPE")) { throw new IllegalStateException("DOCTYPE not allowed in XML to validate"); }

Try / catch

try { xsdValidator.validate(sourceXML); } catch (IOException e) { if (String.valueOf(e.getMessage()).contains("DisallowedDocType")) { routeToErrorRow(row, "Document contains a DOCTYPE"); } else { throw e; } }

Prevention

When it happens

Trigger: xsdValidator.validate(sourceXML) parses XML that contains a <!DOCTYPE ...> declaration; the disallow-doctype-decl feature or entity resolver fires and throws IOException(message).

Common situations: Validating legacy XML generated with DTDs; third-party feeds embedding <!DOCTYPE>; documents copied from templates with doctype headers while the step enforces XSD-only validation.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/19489e3f82793efa. Report an issue: GitHub.

Appendix: source

Thrown at plugins/xml/core/src/main/java/org/pentaho/di/trans/steps/xsdvalidator/XsdValidator.java:242

          // ---Some documents specify the schema they expect to be validated against,
          // ---typically using xsi:noNamespaceSchemaLocation and/or xsi:schemaLocation attributes
          // ---Schema SchematXSD = factoryXSDValidator.newSchema();
          SchematXSD = factoryXSDValidator.newSchema();
        }

        // Create XSDValidator
        Validator xsdValidator = SchematXSD.newValidator();

        // Prevent against XML Entity Expansion (XEE) attacks.
        // https://www.owasp.org/index.php/XML_Security_Cheat_Sheet#XML_Entity_Expansion
        if ( !meta.isAllowExternalEntities() ) {
          xsdValidator.setFeature( "http://apache.org/xml/features/disallow-doctype-decl", true );
          xsdValidator.setFeature( "http://xml.org/sax/features/external-general-entities", false );
          xsdValidator.setFeature( "http://xml.org/sax/features/external-parameter-entities", false );
          xsdValidator.setProperty( "http://apache.org/xml/properties/internal/entity-resolver",
            (XMLEntityResolver) xmlResourceIdentifier -> {
              String message = BaseMessages.getString( PKG, "XsdValidator.Exception.DisallowedDocType" );
              throw new IOException( message );
            } );
        }

        // Validate XML / XSD
        xsdValidator.validate( sourceXML );

        isvalid = true;

      } catch ( SAXException ex ) {
        validationmsg = ex.getMessage();
      } catch ( IOException ex ) {
        validationmsg = ex.getMessage();
      } finally {
        try {
          if ( xsdfile != null ) {
            xsdfile.close();
          }
        } catch ( IOException e ) {

View on GitHub (pinned to f3058517a1)