Will It Vibe?XML external entities explicitly enabled (Java)
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
setFeature enables external-general-entities/load-external-dtd (or disables disallow-doctype-decl), which opens the parser to XXE: file disclosure and SSRF via crafted XML.
Why it matters
Enabling external-general-entities or load-external-dtd (or disabling disallow-doctype-decl) turns on XML external entity processing. A crafted document can then read local files or make the server fetch internal URLs (XXE and SSRF). This is a serious misconfiguration in a widely used parser.
How to fix it
Disable DOCTYPE processing on the factory: setFeature("http://apache.org/xml/features/disallow-doctype-decl", true), and leave external-general-entities and external-parameter-entities false and load-external-dtd false. Apply the same hardening to every XML factory in the codebase.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo