/**
 * Pass: xml-entity-expansion (CWE-776 / CWE-611, category: security)
 *
 * Pattern pass — flags XML parser instantiation that does *not* disable
 * DTD / external-entity processing in the same file. This covers:
 *   - Billion-laughs / quadratic blow-up DoS (CWE-776)
 *   - External-entity disclosure (CWE-611) [already partially covered by
 *     existing xxe taint sinks; this pass adds the config-level signal]
 *
 * Detection (Java):
 *   Factory instantiation:
 *     - `SAXParserFactory.newInstance()`
 *     - `DocumentBuilderFactory.newInstance()`
 *     - `XMLInputFactory.newInstance()` (StAX)
 *     - `SchemaFactory.newInstance(...)`
 *     - `TransformerFactory.newInstance()`
 *   Safe-feature setters (any of these in the same file silences the
 *   finding for that factory class):
 *     - `setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`
 *     - `setFeature("http://xml.org/sax/features/external-general-entities", false)`
 *     - `setFeature("http://xml.org/sax/features/external-parameter-entities", false)`
 *     - `setProperty(XMLInputFactory.SUPPORT_DTD, false)`
 *     - `setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "")`
 *
 * Detection (Python):
 *   - `xml.etree.ElementTree.parse` / `fromstring` — defxml advises
 *     `defusedxml.ElementTree` instead.
 *   - `lxml.etree.parse(...)` without `XMLParser(resolve_entities=False)`
 *     argument. We only fire if `resolve_entities=False` does NOT appear
 *     in the file.
 *
 * Note: the existing `xxe` taint sinks (`SAXParser.parse`, `XMLReader.parse`,
 * etc.) already fire when *tainted* XML reaches the parser. This pass is
 * the orthogonal *configuration* signal — fire even on hard-coded inputs
 * because billion-laughs is exploitable via any attacker-supplied entity
 * file even when the parse() argument itself is trusted.
 *
 * Issue: #86, Sprint 6.
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface XmlEntityExpansionResult {
    findings: Array<{
        line: number;
        language: string;
        pattern: string;
        api: string;
    }>;
}
export declare class XmlEntityExpansionPass implements AnalysisPass<XmlEntityExpansionResult> {
    readonly name = "xml-entity-expansion";
    readonly category: "security";
    run(ctx: PassContext): XmlEntityExpansionResult;
    private detectJavaCall;
    private detectPythonCall;
    private fixForJava;
    private fixForPython;
}
//# sourceMappingURL=xml-entity-expansion-pass.d.ts.map