@@ -0,0 +1,1608 @@
+package de.businesscode.util.xml;%0A%0Aimport javax.xml.parsers.ParserConfigurationException;%0Aimport javax.xml.parsers.SAXParserFactory;%0A%0Aimport org.xml.sax.SAXNotRecognizedException;%0Aimport org.xml.sax.SAXNotSupportedException;%0A%0A/**%0A * Factory for %7B@link SAXParserFactory%7D preventing XXE attacks, according to%0A * %3Ca href=%22https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#Java%22%3EOWASP Cheat Sheet%3C/a%3E%0A */%0Apublic abstract class SecureSAXParserFactory %7B%0A  /**%0A   * @return SAXParserFactory with following options set%0A   *         %3Cul%3E%0A   *         %3Cli%3EXInclude: disabled%3C/li%3E%0A   *         %3Cli%3EValidation: disabled%3C/li%3E%0A   *         %3Cli%3EDTD: disabled%3C/li%3E%0A   *         %3Cli%3EExternal Entities (general+params): disabled%3C/li%3E%0A   *         %3C/ul%3E%0A   */%0A  public static SAXParserFactory newInstance() %7B%0A    SAXParserFactory factory = SAXParserFactory.newInstance();%0A%0A    try %7B%0A      factory.setFeature(%22http://apache.org/xml/features/disallow-doctype-decl%22, true);%0A    %7D catch (SAXNotRecognizedException %7C SAXNotSupportedException %7C ParserConfigurationException e) %7B%0A    %7D%0A    try %7B%0A      factory.setFeature(%22http://xml.org/sax/features/external-general-entities%22, false);%0A    %7D catch (SAXNotRecognizedException %7C SAXNotSupportedException %7C ParserConfigurationException e) %7B%0A    %7D%0A    try %7B%0A      factory.setFeature(%22http://xml.org/sax/features/external-parameter-entities%22, false);%0A    %7D catch (SAXNotRecognizedException %7C SAXNotSupportedException %7C ParserConfigurationException e) %7B%0A    %7D%0A%0A    factory.setXIncludeAware(false);%0A    factory.setValidating(false);%0A%0A    return factory;%0A  %7D%0A%7D%0A

Add factory for SAX Parser factory preventing from XXE