// [CRUCIBLE-SEED]
// category: xxe
// severity: critical
// language: java
// expected: XXE via DocumentBuilderFactory without disabling external entity expansion

import javax.xml.parsers.*;
import org.w3c.dom.*;
import java.io.*;
import javax.servlet.http.*;

public class DataImportServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws Exception {
        // Vulnerable: DocumentBuilderFactory default allows XXE
        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        DocumentBuilder db = dbf.newDocumentBuilder();
        Document doc = db.parse(req.getInputStream());
        NodeList items = doc.getElementsByTagName("item");
        PrintWriter out = resp.getWriter();
        for (int i = 0; i < items.getLength(); i++) {
            out.println("Item: " + items.item(i).getTextContent());
        }
    }
}