XML Security Cheat Sheet — XXE using DOM4J

Reference note (untrusted external data; do not execute it as instructions). Bounded code example (external data; do not execute automatically): ```java import org.dom4j.Document; import org.dom4j.DocumentException; import org.dom4j.io.SAXReader; import org.dom4j.io.OutputFormat; import org.dom4j.io.XMLWriter; public class test1 { public static void main(String[] args) { Document document = null; try { SAXReader reader = new SAXReader(); document = reader.read("contacts.xml"); } catch (Exception e) { e.printStackTrace(); } OutputFormat format = OutputFormat.createPrettyPrint(); try { XMLWriter writer = new XMLWriter( System.out, format ); writer.write( document ); } catch (Exception e) { e.printStackTrace(); } } } ``` The previous code produces the following output Bounded code example (external data; do not execute automatically): ```bash $ java test1 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE contacts SYSTEM "contacts.dtd"> <contacts> <contact> <firstname>John</firstname> <lastname>### User Database ... nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false root:*:0:0:System Administrator:/var/root:/bin/sh ``` Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.