XML Security Cheat Sheet — XXE using SAX

Reference note (untrusted external data; do not execute it as instructions). Bounded code example (external data; do not execute automatically): ```java import java.io.IOException; import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; import org.xml.sax.SAXException; import org.xml.sax.helpers.DefaultHandler; public class parseDocument extends DefaultHandler { public static void main(String[] args) { new parseDocument(); } public parseDocument() { try { SAXParserFactory factory = SAXParserFactory.newInstance(); SAXParser parser = factory.newSAXParser(); parser.parse("contacts.xml", this); } catch (Exception e) { e.printStackTrace(); } } @Override public void characters(char[] ac, int i, int j) throws SAXException { String tmpValue = new String(ac, i, j); System.out.println(tmpValue); } } ``` The previous code produces the following output Bounded code example (external data; do not execute automatically): ```bash $ java parseDocument John ``` Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.