Re: Fwd: XXE

2013-02-01 Thread Cezar Andrei
I'm not sure I understand exactly what you're looking for but I'll give it a try. It's possible to pass the exact XML parser that XMLBeans should use, see http://xmlbeans.apache.org/docs/2.6.0/reference/org/apache/xmlbeans/XmlOptions.html#setLoadUseXMLReader(org.xml.sax.XMLReader) and

Re: Fwd: XXE

2013-02-01 Thread Jon Gorrono
OK, thanks... that makes sense... ...the term 'feature' I was using from from xerces docs where they use to term to set parsing options on the SAX DocumentBuilderFactory here: http://xerces.apache.org/xerces2-j/features.html We've been able show that we can block the vector by setting the