stanfordnlp/CoreNLP · info

e

Error message

e

What it means

XMLUtils.safeDocumentBuilderFactory() hardens a DocumentBuilderFactory by disabling external DTD/entity loading and enabling secure processing. Some JAXP implementations (or older ones) do not recognize these feature URIs and throw ParserConfigurationException from setFeature(); the code logs the exception ('e' - the stack trace) and returns the factory with whichever features did apply. Hardening may be partial, but XML processing continues.

Solutions

1. Run on a recent JDK whose built-in Xerces supports all secure-processing features
2. Add a current Xerces-J (xercesImpl) to the classpath for full feature support
3. Review the logged stack trace to see which feature was rejected and whether it matters for your threat model
4. If XXE protection is critical, verify the resulting factory behavior or set features yourself in a try/catch per feature

// detect whether the JAXP impl supports secure features before relying on them
org.w3c.dom.DOMImplementation di = org.w3c.dom.bootstrap.DOMImplementationRegistry
    .newInstance().getDOMImplementation("XML 3.0");
String version = javax.xml.parsers.DocumentBuilderFactory.newInstance()
    .getClass().getPackage().getImplementationVersion();
// if version is old/minimal, add xercesImpl to the classpath

When it happens

Trigger: Calling XMLUtils.dbFactory()/safeDocumentBuilderFactory() on a JDK or Xerces version that does not support one of the feature URIs (e.g. http://apache.org/xml/features/dom/create-entity-ref-nodes or FEATURE_SECURE_PROCESSING), so setFeature throws ParserConfigurationException.

Common situations: Running on a minimal/older JDK JAXP implementation; embedding CoreNLP in a container with a stripped XML parser; using a non-Xerces DocumentBuilderFactory on the classpath.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Error configuring XML parser: ${e}
• org.xml.sax.SAXException
• Quotes size and gold size don't match!
• XML failure while reading string
• XML failure while reading " + file

AI-assisted analysis of stanfordnlp/CoreNLP@1b7edd19c4 (2026-09-10). Data as JSON: /api/errors/df68549dfe08ae2e. Report an issue: GitHub.

Appendix: source

Thrown at src/edu/stanford/nlp/util/XMLUtils.java:53

 */
public class XMLUtils  {

  /** A logger for this class */
  private static final Redwood.RedwoodChannels log = Redwood.channels(XMLUtils.class);

  private XMLUtils() {} // only static methods

  public static DocumentBuilderFactory safeDocumentBuilderFactory() {
    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    try {
      dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
      dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
      dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
      dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
      dbf.setFeature("http://apache.org/xml/features/dom/create-entity-ref-nodes", false);
      dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    } catch (ParserConfigurationException e) {
      log.warn(e);
    }
    return dbf;
  }
    

  /**
   * Returns the text content of all nodes in the given file with the given tag.
   *
   * @return List of String text contents of tags.
   */
  public static List<String> getTextContentFromTagsFromFile(File f, String tag) {
    List<String> sents = Generics.newArrayList();
    try {
      sents = getTextContentFromTagsFromFileSAXException(f, tag);
    } catch (SAXException e) {
      log.warn(e);
    }
    return sents;

View on GitHub (pinned to 1b7edd19c4)