Java

Lab DocumentBuilder/TransformerFactory features to disable, tiny file:// entity to a lab file, parser throws or ignores — no FTP exfil.

Lab Java snippet that logs a lookup string, how to disable JNDI/message lookups, sanitized crash on a bad URL — no LDAP exploit server.