// [CRUCIBLE-SEED]
// category: xxe
// severity: critical
// language: java
// expected: XXE via SAXParser without secure processing feature enabled

import javax.xml.parsers.*;
import org.xml.sax.helpers.DefaultHandler;
import java.io.*;
import javax.servlet.http.*;

public class FeedParserServlet extends HttpServlet {
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws Exception {
        // Vulnerable: SAXParserFactory default config allows external entity inclusion
        SAXParserFactory factory = SAXParserFactory.newInstance();
        SAXParser parser = factory.newSAXParser();
        DefaultHandler handler = new DefaultHandler();
        parser.parse(req.getInputStream(), handler);
        resp.getWriter().println("Feed parsed");
    }
}