JAXP, the Java API for XML Processing, is the standard Java framework for reading, parsing, validating, transforming, and querying XML. It provides common classes for tasks such as building DOM trees, streaming XML with SAX or StAX, running XSLT transformations, and evaluating XPath expressions.
In cybersecurity, JAXP matters because XML parsers and transformers often process data from untrusted sources. If secure settings are missing, attackers can abuse features such as external entities, overly permissive stylesheet handling, or unsafe XPath processing to read local files, trigger server-side requests, or cause denial of service. Defenders harden JAXP by disabling external entity resolution, restricting network and file access, setting secure-processing flags, and using least-privilege defaults in every XML entry point.