Describe the bug
semanticcpg/src/main/scala/io/shiftleft/semanticcpg/utils/SecureXmlParsing.scala, line 19:
spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false)
this feature should be set to true instead of false to disallow dtd and prevent XXE attacks
Describe the bug
semanticcpg/src/main/scala/io/shiftleft/semanticcpg/utils/SecureXmlParsing.scala, line 19:
spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false)this feature should be set to
trueinstead offalseto disallow dtd and prevent XXE attacks