Daily security quiz #14

Question for 2026-11-14. Read the code and pick the most serious security vulnerability.

This code reads an uploaded XML configuration file and returns the name as text/plain (using the default JDK parser). What is the most serious vulnerability?

1DocumentBuilderFactory f = DocumentBuilderFactory.newInstance();
2DocumentBuilder builder = f.newDocumentBuilder();
3Document doc = builder.parse(uploadedFile.getInputStream());
4 
5String name = doc.getElementsByTagName("name").item(0).getTextContent();
6response.getWriter().write("Configuration name: " + name);

1. AJSON should be used instead of XML
2. BThe stream returned by getInputStream is not closed
3. CExternal entities are not blocked, allowing server files to be read or requests to be sent to the internal network (XXE)
4. DAn exception occurs if item(0) is null