java-xml-arbitrary-file-inclusion-mining
Read-only mining codemod for SonarSource rule java:S6373 — XML parsers should not allow inclusion of arbitrary files.
It scans Java source and emits metrics only; it never modifies code (return null).
Findings are high-signal review candidates surfaced by AST pattern matching — they are
not proven vulnerabilities. A static mining pass cannot prove an end-to-end taint flow
from an untrusted source to the sink, so confirm data flow before remediating.
| Field | Value |
|---|---|
| Rule key | java:S6373 |
| Type | Vulnerability |
| Severity | Blocker |
| Primary CWE | CWE-611 (XML External Entity Injection) |
| Tags | symbolic-execution |
What it detects
XML parser factory instantiations, flagging whether the file disables external DTD/entity resolution.
Sinks:
DocumentBuilderFactory / SAXParserFactory / XMLInputFactory / TransformerFactory / SchemaFactory.newInstanceXMLReaderFactory.createXMLReadernew SAXBuilder / SAXReader
Emission rule: Emits for every parser factory site; hardened=true when the file disables external resolution (ACCESS_EXTERNAL_DTD/SCHEMA/STYLESHEET, external-general-entities, external-parameter-entities, load-external-dtd, disallow-doctype-decl, FEATURE_SECURE_PROCESSING).
Metric: java-xml-arbitrary-file-inclusion-mining
| dimension | meaning |
|---|---|
rule | SonarSource rule key |
cwe | primary CWE identifier |
severity | always blocker |
sink | the detected sink (method/constructor) |
package_name | enclosing Java package |
class_name | enclosing class/interface/enum/record |
method_name | enclosing method/constructor (or <none>) |
file | file path (relative to scan target) |
line | 1-based line of the finding |
hardened | true if the file applies a known XXE/external-entity hardening call, else false |
Security standards
- CWE-611 (XML External Entity Injection)
- CWE-827 (Improper Control of Document Type Definition)
- OWASP ASVS 4.0: 5.5.2
- OWASP Top 10 2021: A5
- OWASP Top 10: A4
- PCI DSS 3.2: 6.5.1
- PCI DSS 4.0: 6.2.4
- STIG ASD V5R3: V-222608
Run locally
Part of the java-security-blocker-mining suite covering 19 blocker-severity
Java vulnerability rules. Each codemod is read-only and emits a single named metric.