XML and Serialization Hardening

Secure parsing and processing of XML and serialized data. Prevent XXE, entity expansion, SSRF, DoS, and unsafe deserialization across platforms.

XML Parser Hardening

• Disable DTDs and external entities by default; reject DOCTYPE declarations.
• Validate strictly against local, trusted XSDs; set explicit limits (size, depth, element counts).
• Sandbox or block resolver access; no network fetches during parsing; monitor for unexpected DNS activity.

Java

Java parsers have XXE enabled by default. Primary defense -- disallow DTDs completely:

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setXIncludeAware(false);