// [CRUCIBLE-SEED]
// category: xxe
// severity: critical
// language: java
// expected: XXE via XMLReader without disabling external entities or DOCTYPE processing

import org.xml.sax.*;
import org.xml.sax.helpers.XMLReaderFactory;
import java.io.StringReader;
import javax.servlet.http.*;

public class XmlImportServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws Exception {
        String xmlBody = new String(req.getInputStream().readAllBytes());
        // Vulnerable: XMLReader with default settings processes external entities
        XMLReader reader = XMLReaderFactory.createXMLReader();
        reader.setContentHandler(new org.xml.sax.helpers.DefaultHandler());
        reader.parse(new InputSource(new StringReader(xmlBody)));
        resp.getWriter().println("XML processed");
    }
}