<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at

      http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<!DOCTYPE document PUBLIC "-//APACHE//DTD Documentation V2.0//EN" "http://forrest.apache.org/dtd/document-v20.dtd">
<document>
    <header>
        <title>Welcome to Apache XMLBeans™</title>
    </header>
    <body>
        <section>
            <title>What is XMLBeans?</title>
            <p>XMLBeans is a technology for accessing XML by binding it to Java types. XMLBeans
                provides several ways to get at the XML, including:
            </p>
            <ul>
                <li>Through XML schema that has been compiled to generate Java types that represent
                    schema types. In this way, you can access instances of the schema through
                    JavaBeans-style accessors after the fashion of "getFoo" and "setFoo".
                    <p>The XMLBeans API also allows you to reflect into the XML schema itself
                        through an XML Schema Object model.
                    </p>
                </li>
                <li>A cursor model through which you can traverse the full XML infoset.</li>
                <li>Support for XML DOM.</li>
            </ul>
            <p>For a more complete introduction, see the <a href="site:overview">XMLBeans
                Overview
            </a> or <a href="site:gettingstarted">Getting
                Started With XMLBeans</a>.
            </p>
            <p>For more details on XMLBeans see the
                <a href="ext:wiki">XMLBeans Wiki pages</a>
                or the XMLBeans documentation (the Documentation tab on this website).
            </p>
        </section>

        <section>
            <title>Release: Apache XMLBeans 5.4.1 (Sept 23, 2026)</title>
            <p>
                Latest release files <a href="site:download/index">are available</a>.
            </p>
            <p>The Apache <a href="https://poi.apache.org">POI</a> project has unretired the XMLBeans codebase
                since 3.0.0 and is maintaining it as a sub-project.
            </p>
            <p>
                Some bug fixes and packaging clean-up (for a more complete list of changes see
                <a href="site:home/changes">CHANGES.txt</a> or
                <a href="https://issues.apache.org/jira/browse/XMLBEANS-673?jql=project%20%3D%20XMLBEANS%20AND%20fixVersion%20%3D%205.4.1">JIRA</a>).
            </p>
        </section>

        <section>
            <title>CVE-2021-23926 - XML External Entity (XXE) Processing in Apache XMLBeans versions prior to 3.0.0
                (January 13, 2021)
            </title>
            <p>Description:
                <br/>
                When parsing XML files using XMLBeans 2.6.0 or below, the underlying parser
                created by XMLBeans could be susceptible to XML External Entity (XXE) attacks.
            </p>

            <p>This issue was fixed a few years ago but on review, we decided we should have a CVE
                to raise awareness of the issue.
            </p>

            <p>Mitigation:
                <br/>
                Affected users are advised to update to Apache XMLBeans 3.0.0 or above
                which fixes this vulnerability. XMLBeans 4.0.0 or above is preferable.
            </p>

            <p>References:
                <a href="https://en.wikipedia.org/wiki/XML_external_entity_attack">XML external entity attack</a>
            </p>
        </section>

        <section>
            <title></title>
            <p>
                <a href="site:history">Version history</a>
            </p>
        </section>


        <section>
            <title>Getting Started</title>
            <section>
                <title>Start off with your own stuff.</title>
                <p>If you want to get right to it with your own XML schema and instance, follow these basic steps:</p>
                <ol>
                    <li>
                        <a href="site:install">Install XMLBeans.</a>
                    </li>
                    <li>Compile your schema. Use
                        <a href="site:tools/scomp">
                            <code>scomp</code>
                        </a>
                        to compile the schema, generating and jarring Java types. For example, to create a
                        employeeschema.jar from an employeesschema.xsd file:
                        <source>scomp -out employeeschema.jar employeeschema.xsd</source>
                    </li>
                    <li>Write code. With the generated JAR on your classpath, write code to bind an XML instance
                        to the Java types representing your schema. Here's an example that would use
                        types generated from an employees schema:
                        <source>
                            File xmlFile = new File("c:\employees.xml");

                            // Bind the instance to the generated XMLBeans types.
                            EmployeesDocument empDoc =
                            EmployeesDocument.Factory.parse(xmlFile);

                            // Get and print pieces of the XML instance.
                            Employees emps = empDoc.getEmployees();
                            Employee[] empArray = emps.getEmployeeArray();
                            for (int i = 0; i &lt; empArray.length; i++)
                            {
                            System.out.println(empArray[i]);
                            }
                        </source>
                    </li>
                </ol>
            </section>
            <section>
                <title>Read a tutorial.</title>
                <p>Read our <a href="site:tutorial">tutorial</a> to get a sense of XMLBeans
                    basics.
                </p>
            </section>
            <section>
                <title>Read documentation and other information.</title>
                <p>On our <a href="site:documentation/index">documentation</a> page, you'll find links to
                    several topics that describe XMLBeans features and how to use them. You'll also
                    find links to Javadoc reference on the XMLBeans API.
                </p>
                <p>You can also check out the <a href="site:faq">FAQ</a>, which is updated
                    with new answers as they're needed.
                </p>
                <p>Don't forget the <a href="ext:wiki">XMLBeans Wiki</a>, which collects
                    lots of valuable information.
                </p>
            </section>
            <section>
                <title>Check out the samples.</title>
                <p>Many of the XMLBeans features are illustrated in our <a href="site:samples/index">samples</a>.
                </p>
            </section>
        </section>
    </body>
</document>
