Hi Daniel, Sounds like a good idea to me
Jacques Le 22/08/2026 à 00:33, Daniel Dekany a écrit :
In freemarker.ext.dom.NodeModel (main DOM-to-data-model wrapper) we have these legacy static helpers in subject, and these all use a DocumentBuilderFactory where external entity resolution is (probably) on, and so they open the gate for XXE (XML External Entity) attacks, of someone processes XML document from untrusted source. While this is documented there, it's really easy to miss, and even just accidentally use NodeModel.getDocumentBuilderFactory(). I would like to @Deprecate all of these, urgently, so if someone calls them the IDE will warn them.
