From bd1298b5ed7cea95312b37972ad00f047ea9b38c Mon Sep 17 00:00:00 2001
From: Mitch Gaffigan <mitch.gaffigan@comcast.net>
Date: Sat, 19 Sep 2026 09:10:11 -0500
Subject: [PATCH] Default server to not allow XXE on JAXP API's

Signed-off-by: Mitch Gaffigan <mitch.gaffigan@comcast.net>
---
 server/conf/base_includes.vmoptions | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/server/conf/base_includes.vmoptions b/server/conf/base_includes.vmoptions
index ecfd6d87fa..a917ee6069 100644
--- a/server/conf/base_includes.vmoptions
+++ b/server/conf/base_includes.vmoptions
@@ -6,3 +6,6 @@
 -Xmx256m
 -Djava.awt.headless=true
 -Dapple.awt.UIElement=true
+-Djavax.xml.accessExternalDTD=
+-Djavax.xml.accessExternalSchema=
+-Djavax.xml.accessExternalStylesheet=