Improper Restriction of XML External Entity Reference ('XXE')

object InvoiceQuery {
  @throws[Exception]
  def runAll(sources: Array[String]): Unit = {
    fullyLockedDown(sources(0))
    externalAccessDenied(sources(0))
    defaultsLeftAlone(sources(0))
  }

  @throws[Exception]
  def fullyLockedDown(location: String): Unit = {
    val factory = DocumentBuilderFactory.newInstance
    factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "")
    factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "")
    factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true)
    factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)

    val builder = factory.newDocumentBuilder
    val xpath = XPathFactory.newInstance.newXPath
    val query = xpath.compile("/invoice/total/text()")
    val total = query.evaluate(builder.parse(location))
  }

  @throws[Exception]
  def externalAccessDenied(location: String): Unit = {
    val factory = DocumentBuilderFactory.newInstance
    factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "")
    factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "")
    val builder = factory.newDocumentBuilder
    val xpath = XPathFactory.newInstance.newXPath
    val query = xpath.compile("/invoice/total/text()")
    val total = query.evaluate(builder.parse(location))
  }

  // Handing the expression an InputSource lets it do its own parsing, with the defaults.
  @throws[Exception]
  def defaultsLeftAlone(location: String): Unit = {
    val factory = DocumentBuilderFactory.newInstance
    val builder = factory.newDocumentBuilder
    val xpath = XPathFactory.newInstance.newXPath
    val query = xpath.compile("/invoice/total/text()")
    // VULNERABLE: Improper Restriction of XML External Entity Reference ('XXE')
    query.evaluate(new InputSource(location), null)
  }
}