2. Specify protocol(s) allowed for entity access

Configuration on Java

  • Feature ResolverFeature.ACCESS_EXTERNAL_ENTITY (type: String)

  • System property xml.catalog.accessExternalEntity

  • Property file property access-external-entity

Configuration on .NET

  • Feature ResolverFeature.ACCESS_EXTERNAL_ENTITY (type: string)

  • Environment variable XML_CATALOG_ACCESS_EXTERNAL_ENTITY

  • Property file property accessExternalEntity

This feature restricts the protocols that are allowed during entity resolution. If an attempt is made to resolve an entity and the URI for that entity uses a protocol not listed in this feature, the request is rejected. See JAXP 185.

The keyword “all” allows all protocols. An empty string allows none.

The default value for this feature is “all”.