I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android.
I'm having some difficulty getting any common attacks to work, but I want to be sure I haven't missed any possibilities. What are the minimum requirements/features this parser needs to have enabled for XXE processing attacks to be successful?
In particular I am looking at whether the features for XmlPullParser.FEATURE_PROCESS_NAMESPACES and XmlPullParser.FEATURE_PROCESS_DOCDECL are enabled or not.