== XXE mitigation

In order to protect against XXE attacks you need to make sure you validate the input received from an untrusted client.
In the Java world you can also instruct your parser to ignore DTD completely, for example:

[source]
----
XMLInputFactory xif = XMLInputFactory.newFactory();
xif.setProperty(XMLInputFactory.SUPPORT_DTD, false);
----

if you are not able to completely switch off the DTD support, you can also instruct the XML parser to ignore external entities, like:

[source]
----
XMLInputFactory xif = XMLInputFactory.newFactory();
xif.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
xif.setProperty(XMLInputFactory.SUPPORT_DTD, true);
----

For more information about configuration, see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet
