title: how to fix 'Disable XML external entity (XXE) processing' vulnerabilities in java
body: <p>I ran my java code against sonarqube and I got 'Disable XML external entity (XXE) processing' as vulnerability. I spend some time on google to resolve the issue. I have been trying alot of approach but nothing is working for me. I don't know what I'm missing</p>
  
  <p>My Code:</p>
  
  <pre><code>        final DocumentBuilderFactory docFactory = DocumentBuilderFactory.newInstance();
          docFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
          docFactory.setFeature(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
          docFactory.setFeature(XMLInputFactory.SUPPORT_DTD, false);
  
          docFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
          docFactory.setFeature("http://xml.org/sax/features/external-general-entities", false);
          docFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
          docFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
  
          final DocumentBuilder docBuilder = docFactory.newDocumentBuilder();
          final Document doc = docBuilder.parse(filepath);
  </code></pre>
  
  <p>I'm using java 1.8, Any help is appreciated. Thanks</p>