今早收到產(chǎn)品的微信說收到微信通知如下：
【微信支付】安全提醒：請貴司技術(shù)人員排查系統(tǒng)是否存在名為XXE的常見漏洞，其危害較大，點擊查看修復(fù)指引 http://url.cn/55h4BVd ，謝謝。

根據(jù)上面的文檔查看相關(guān)通知接口
發(fā)現(xiàn)我們是用的是dom4j的DocumentHelper

package com.tcl.jsapi.util;

import java.io.StringReader;
import java.util.StringTokenizer;

import org.apache.log4j.Logger;
import org.dom4j.Document;
import org.dom4j.DocumentException;
import org.dom4j.io.SAXReader;
import org.xml.sax.InputSource;
import org.xml.sax.SAXException;

public class SecurityXMPHelper {

    private static final Logger log = Logger.getLogger(SecurityXMPHelper.class);

     public static Document parseText(String text) throws DocumentException {
            Document result = null;

            SAXReader reader = new SAXReader();
            
            try {
                reader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
                reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
                reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
                
            } catch (SAXException e) {
                log.error("SAXException", e);
            }
            
            String encoding = getEncoding(text);

            InputSource source = new InputSource(new StringReader(text));
            source.setEncoding(encoding);

            result = reader.read(source);

            // if the XML parser doesn't provide a way to retrieve the encoding,
            // specify it manually
            if (result.getXMLEncoding() == null) {
                result.setXMLEncoding(encoding);
            }

            return result;
        }
     
     private static String getEncoding(String text) {
            String result = null;

            String xml = text.trim();

            if (xml.startsWith("<?xml")) {
                int end = xml.indexOf("?>");
                String sub = xml.substring(0, end);
                StringTokenizer tokens = new StringTokenizer(sub, " =\"\'");

                while (tokens.hasMoreTokens()) {
                    String token = tokens.nextToken();

                    if ("encoding".equals(token)) {
                        if (tokens.hasMoreTokens()) {
                            result = tokens.nextToken();
                        }

                        break;
                    }
                }
            }

            return result;
        }
}