Potential fix for code scanning alert no. 66: Resolving XML external entity in user-controlled data

[JDGologic]

Potential fix for https://github.com/JDGologic/WebGoat/security/code-scanning/66

To fix the XXE vulnerability, always configure the XMLInputFactory to prevent access to external entities—regardless of securityEnabled flag. The recommended mitigation for StAX is to set the properties XMLConstants.ACCESS_EXTERNAL_DTD and XMLConstants.ACCESS_EXTERNAL_SCHEMA to empty strings, which disables access to external resources.

• In CommentsCache.java, within parseXml(String xml, boolean securityEnabled), remove the conditional and set these two properties unconditionally before parsing the XML.
• You may remove the securityEnabled flag or keep it for educational purposes, but security should always be enforced when handling untrusted XML.
• No additional dependencies are needed, only use of standard Java XML APIs.

Files/regions to change:

• CommentsCache.java: Replace the block in parseXml that conditionally sets properties with code that always sets protective properties.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None