How to Configure WebLogic Server not to Reference an External Document Type Definition (DTD) Defined in <!DOCTYPE> (Doc ID 2582120.1)

Last updated on NOVEMBER 10, 2023

Applies to:

Goal

When WebLogic server receives an XML document such as an SAML response that has <!DOCTYPE> containing external DTD reference as follows, the XML parser in WebLogic will follow the reference to the http:/external-website to get the sample.dtd so that it can validate the received XML document against the DTD file. 

This may present security concern for some running environments that do not allow WebLogic to retrieve information from an external website. How to disable to default behavior?

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.