title: Fortify XML External Entities (XXE)
body: <p>I got a XML External Entity Injection security warn of line 4 in fortify report. Have no idea how to fix it. I'm quite new to SOAP,JAXB, and Marshaller.</p>
  
  <pre><code>1    private TargetObject convert( ResponseEntity&lt;String&gt; response ) throws JAXBException{
  
  2       JAXBContext jaxbContext = JAXBContext.newInstance( TargetObject.class );
  
  3       Unmarshaller unmarshaller = jaxbContext.createUnmarshaller();
  
  4       StringReader reader = new StringReader( Objects.requireNonNull( response.getBody() ) );
  
  5       TargetObject targetObject = (ArrayOfOrderList) unmarshaller.unmarshal( reader );
  
  6       return targetObject;
  
  7    }
  </code></pre>
  
  <p>line 4 (XML External Entity Injection) High<br/>
  Issue Details<br/>
  Kingdom: Input Validation and Representation<br/>
  Scan Engine: SCA (Semantic)<br/>
  Sink Details<br/>
  Sink: unmarshal()</p>
  
  <p>Thanks in advance!</p>