Update: XML External Entity Prevention Cheat Sheet

[JoeFound]

What is missing or needs to be updated?

The section JAXP DocumentBuilderFactory, SAXParserFactory and DOM4J is a bit confusing to understand correctly when deciding what are the features to consider.
The section:
// and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks" dbf.setXIncludeAware(false); dbf.setExpandEntityReferences(false);
sounds as it is required only when disallow-doctype-decl is not applicable, whilst it is required in all cases.

Additionally setExpandEntityReferences(false); is a not available for SAXParserFactory, where it would be possible to use

setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
to mitigate the risk of Resource Exaustion.

How should this be resolved?

Adding additional comments before the dbf.setXIncludeAware(false); line to clarify that is required regardless of the Xerces version and possibly add a separate code snippet section featuring the remediation for SAXParserFactory.

[mackowski]

Good point! Thanks! @JoeFound do you want to make a PR?

[JoeFound]

Closing this Issue, since the PR is now merged