Update: XML_External_Entity_Prevention_Cheat_Sheet.html#validator

[cgocast]

What is missing or needs to be updated?

The sample to a protect a javax.xml.validation.Validator does not follow the recommendations given to protect a javax.xml.validation.SchemaFactory. The following lines are missing:

factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");

How should this be resolved?

Add the two missing lines in the sample.

Add a link to [the documentation of newValidator()](https://docs.oracle.com/javase%2F7%2Fdocs%2Fapi%2F%2F/javax/xml/validation/Schema.html#newValidator()) which states:

Implementors should assure that the properties set on the SchemaFactory that created this Schema are also set on the Validator constructed.

[mackowski]

It is documented how to protect SchemaFactory https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.md#schemafactory

[cgocast]

Yes, I am aware. I am just saying that the sample given in https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.md#validator does not follow the recommendations you are linking to. In my opinion, OWASP Cheat Sheet should avoid giving code samples that are bad practice.

[mackowski]

Yes @cgocast good catch! Do you want to make a PR for this one?

[cgocast]

Sure, I will write a PR.

[mackowski]

Awesome thanks!