> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aseeflow.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring XML Handling

Spin can be configured to change XML parsing, writing, and mapping settings. Spin uses JAXB and DOM to handle XML.
Therefore, the XML data format uses instances of `javax.xml.parsers.DocumentBuilderFactory`,
`javax.xml.transform.TransformerFactory`, and `javax.xml.bind.JAXBContext` that can be configured using Spin's
[configuration mechanism](/reference/spin/extending-spin#configuring-data-formats).

For example, a custom application may provide an implementation of `org.camunda.spin.spi.DataFormatConfigurator` that exchanges
the `JAXBContext`. Spin uses and caches the context to improve performance.

The data format class to register a configurator for is `org.camunda.spin.impl.xml.dom.format.DomXmlDataFormat`.
An instance of this class provides setter methods (for the entities mentioned above) that can be used to replace the
default object mapper. Refer to the [JDK documentation](http://docs.oracle.com/javase/8/docs/api/) on what
configuration can be applied.

### Safe XML processing

The Spin XML data format provides the following configuration properties to enable secure parsing of XML documents:

<table class="table table-striped">
  <tr> <th>Property</th> <th>Description</th> </tr>
  <tr> <td><code>xxe-processing</code></td> <td>Toggle the processing of External XML Entities (XXE) in an XML document. Disable to prevent [XXE attacks](https://en.wikipedia.org/wiki/XML_external_entity_attack). Default value: <code>false</code> </td> </tr>
  <tr> <td><code>secure-processing</code></td> <td>Toggle the [secure processing of an XML document](https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html). Default value: <code>true</code> </td> </tr>
</table>

To provide a custom configuration, you can pass these properties in a `Map`, to the `DataFormats.loadDataFormats(...)`
method, similar to the example below:

```java theme={null}
  Map<String, Object> configurationOptions = new HashMap<>();
  configurationOptions.put("xxe-processing", true);
  configurationOptions.put("secure-processing", false);

  DataFormats.loadDataFormats(classloader, configurationOptions);
```