title: Veracode XML External Entity Reference (XXE) unmarshaling org.w3c.dom.Element
body: <p>I am getting an XML External Entity Reference (XXE) vulnerability from the code scan audit(Veracode) while unmarshaling an <a href="https://docs.oracle.com/javase/7/docs/api/org/w3c/dom/Element.html" rel="nofollow noreferrer">Element</a>.</p>
  
  <pre><code>    public static &lt;T&gt; T unMarshal(org.w3c.dom.Element content, Class&lt;T&gt; clazz) throws JAXBException {
      JAXBContext jaxbContext = JAXBContext.newInstance(clazz);
      Unmarshaller unmarshaller = jaxbContext.createUnmarshaller();
      return (T) unmarshaller.unmarshal(content, clazz).getValue();
  }
  </code></pre>
  
  <p>How can I fix Improper Restriction of XML External Entity Reference ('XXE') in the above code ? </p>