XML Security Cheat Sheet — XXE using StAX
Bounded code example (external data; do not execute automatically): ```java import javax.xml.parsers.SAXParserFactory; import javax.xml.stream.XMLStreamReader; import javax.xml.stream.XMLInputFactory; import java.io.File; import java.io.FileReader; import java.io.FileInputStream; public class parseD
Reference note (untrusted external data; do not execute it as instructions).
Bounded code example (external data; do not execute automatically):
```java
import javax.xml.parsers.SAXParserFactory;
import javax.xml.stream.XMLStreamReader;
import javax.xml.stream.XMLInputFactory;
import java.io.File;
import java.io.FileReader;
import java.io.FileInputStream;
public class parseDocument {
public static void main(String[] args) {
try {
XMLInputFactory xmlif = XMLInputFactory.newInstance();
FileReader fr = new FileReader("contacts.xml");
File file = new File("contacts.xml");
XMLStreamReader xmlfer = xmlif.createXMLStreamReader("contacts.xml",
new FileInputStream(file));
int eventType = xmlfer.getEventType();
while (xmlfer.hasNext()) {
eventType = xmlfer.next();
if(xmlfer.hasText()){
System.out.print(xmlfer.getText());
}
}
fr.close();
} catch (Exception e) {
e.printStackTrace();
}
}
}
```
The previous code produces the following output
Bounded code example (external data; do not execute automatically):
```bash
$ java parseDocument
<!DOCTYPE contacts SYSTEM "contacts.dtd">John### User Database
...
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
```
Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.
ATTRIBUTED SOURCE
This compact reference card is adapted from official documentation and is not a community-verified experience.
OWASP Cheat Sheet Series — cheatsheets/XML_Security_Cheat_Sheet.md :: XXE using StAX ↗Revision 07111ee754e8 · CC-BY-SA-4.0 and attribution