{"action":"created","issue":{"url":"https://api.github.com/repos/kyleburton/clj-xpath/issues/25","labels_url":"https://api.github.com/repos/kyleburton/clj-xpath/issues/25/labels{/name}","comments_url":"https://api.github.com/repos/kyleburton/clj-xpath/issues/25/comments","events_url":"https://api.github.com/repos/kyleburton/clj-xpath/issues/25/events","html_url":"https://github.com/kyleburton/clj-xpath/issues/25","id":99459931,"number":25,"title":"OWASP XXE Vulnerability ","user":{"login":"kyleburton","id":69799,"avatar_url":"https://avatars.githubusercontent.com/u/69799?v=3","gravatar_id":"","url":"https://api.github.com/users/kyleburton","html_url":"https://github.com/kyleburton","followers_url":"https://api.github.com/users/kyleburton/followers","following_url":"https://api.github.com/users/kyleburton/following{/other_user}","gists_url":"https://api.github.com/users/kyleburton/gists{/gist_id}","starred_url":"https://api.github.com/users/kyleburton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kyleburton/subscriptions","organizations_url":"https://api.github.com/users/kyleburton/orgs","repos_url":"https://api.github.com/users/kyleburton/repos","events_url":"https://api.github.com/users/kyleburton/events{/privacy}","received_events_url":"https://api.github.com/users/kyleburton/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-08-06T15:14:10Z","updated_at":"2015-08-30T00:56:37Z","closed_at":"2015-08-06T15:16:57Z","body":"Louis Nyffenegger informed me of the [OWASP XXE Processing Vulnerability](https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing).\r\n\r\nThe proposed solution is to configure the dom parser with the following features and default values:\r\n\r\n    (.setFeature XMLConstants/FEATURE_SECURE_PROCESSING (:feature-secure-processing   opts true))\r\n    (.setFeature disallow-doctype-decl                  (:disallow-doctype-decl       opts true))\r\n    (.setFeature external-general-entities              (:external-general-entities   opts false))\r\n    (.setFeature external-parameter-entities            (:external-parameter-entities opts false))\r\n\r\nA patch, tests and a release will be forthcoming.\r\n\r\nKyle"},"comment":{"url":"https://api.github.com/repos/kyleburton/clj-xpath/issues/comments/136066925","html_url":"https://github.com/kyleburton/clj-xpath/issues/25#issuecomment-136066925","issue_url":"https://api.github.com/repos/kyleburton/clj-xpath/issues/25","id":136066925,"user":{"login":"kyleburton","id":69799,"avatar_url":"https://avatars.githubusercontent.com/u/69799?v=3","gravatar_id":"","url":"https://api.github.com/users/kyleburton","html_url":"https://github.com/kyleburton","followers_url":"https://api.github.com/users/kyleburton/followers","following_url":"https://api.github.com/users/kyleburton/following{/other_user}","gists_url":"https://api.github.com/users/kyleburton/gists{/gist_id}","starred_url":"https://api.github.com/users/kyleburton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kyleburton/subscriptions","organizations_url":"https://api.github.com/users/kyleburton/orgs","repos_url":"https://api.github.com/users/kyleburton/repos","events_url":"https://api.github.com/users/kyleburton/events{/privacy}","received_events_url":"https://api.github.com/users/kyleburton/received_events","type":"User","site_admin":false},"created_at":"2015-08-30T00:56:37Z","updated_at":"2015-08-30T00:56:37Z","body":"@wagjo, looking at the documentation for load-external-dtd:\r\n\r\n  https://xerces.apache.org/xerces2-j/features.html#nonvalidating.load-external-dtd\r\n\r\nIt states \"Note: \tThis feature is always on when validation is on.\" which seems to be in conflict with what you're looking for (validation but no loading of the external dtd).  I've tried setting load-external-dtd to false and validating to true, but the document builder still fetches the DTD.  Are you aware of how to achieve the behavior you are asking for?  Asking to perform validation but not fetch the DTDs necessary for validation sounds incompatible.\r\n\r\nKyle"}}