SAX parser XXE not disabled

Code reviewCode quality & reviewSenior–Staff~22 min

Review this Java method that parses an inbound SOAP body with a SAX reader.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 22 min

Mark a line and say what kind of problem it is.0 findings

1public void handleSoap(String soapBody, ContentHandler handler) throws Exception {

2 SAXParserFactory spf = SAXParserFactory.newInstance();

3 spf.setNamespaceAware(true);

4 SAXParser parser = spf.newSAXParser();

5 XMLReader reader = parser.getXMLReader();

6 reader.setContentHandler(handler);

7 reader.setErrorHandler(new DefaultHandler());

8 InputSource src = new InputSource(new StringReader(soapBody));

9 reader.parse(src);

10 log.info("parsed soap body, {} bytes", soapBody.length());

11}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.