title: Resolving XXE for Oracle DomParser
body: <p>Here is the code snippet for a DomParser which I am using, The DomParser which I am using is of Oracle.</p>
  
  <pre><code>import oracle.xml.parser.v2.DOMParser;
  
  DOMParser domParser = new DOMParser();      
  domParser.parse(new StringReader(xmlPayload));    
  Document doc = domParser.getDocument();
  
  doc.getDocumentElement().normalize();
  System.out.println("Root element :" + doc.getDocumentElement().getNodeName());
  NodeList nList = doc.getElementsByTagName("student");
  </code></pre>
  
  <p>Recently our Security team has raised a concern that the above DOM parser is vulnerable to security attack and has come up with a recommendation on setting two attributes </p>
  
  <pre><code>domParser.setAttribute("RESOLVE_ENTITY_DEFAULT", true);
  domParser.setAttribute("DEFAULT_ENTITY_EXPANSION_DEPTH", 150);
  </code></pre>
  
  <p>But on setting these attributes, I am getting the below error, </p>
  
  <pre><code>Exception in thread "main" java.lang.IllegalArgumentException
  at oracle.xml.parser.v2.XMLParser.setAttribute(XMLParser.java:870)
  at oracle.xml.parser.v2.DOMParser.setAttribute(DOMParser.java:538)
  at DomParserExample.main(DomParserExample.java:20)
  </code></pre>
  
  <p>kindly let me know how can I prevent XML Entity Expansion injection and XXE attacks.  I have tried looking into  OWASP XEE Cheat Sheet and browsed through various questions and answers for XXE attack, but could not find a solution for this.</p>