To effectively protect internal grails parsing against XXE vulnerabilities it is necessary to set the disallow-doctype-decl feature to true and not false. See https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing.

Author: Luis Arias

grails-bootstrap/src/main/groovy/org/codehaus/groovy/grails/io/support/IOUtils.java

@@ -367,7 +367,7 @@ private static SAXParserFactory createParserFactory() throws ParserConfiguration
             saxParserFactory.setValidating(false);
 
             try {
-                saxParserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);
+                saxParserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
             } catch (Exception pce) {
                 // ignore, parser doesn't support
             }