docs: public static void safeTransform(@Nonnull Source source, @Nonnull Result out) throws TransformerException,
              SAXException {
  
          InputSource src = SAXSource.sourceToInputSource(source);
          if (src != null) {
              SAXTransformerFactory stFactory = (SAXTransformerFactory) TransformerFactory.newInstance();
              stFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
  
              XMLReader xmlReader = XMLReaderFactory.createXMLReader();
              try {
                  xmlReader.setFeature(FEATURE_HTTP_XML_ORG_SAX_FEATURES_EXTERNAL_GENERAL_ENTITIES, false);
              }
              catch (SAXException ignored) { /* ignored */ }
              try {
                  xmlReader.setFeature(FEATURE_HTTP_XML_ORG_SAX_FEATURES_EXTERNAL_PARAMETER_ENTITIES, false);
              }
              catch (SAXException ignored) { /* ignored */ }
              // defend against XXE
              // the above features should strip out entities - however the feature may not be supported depending
              // on the xml implementation used and this is out of our control.
              // So add a fallback plan if all else fails.
              xmlReader.setEntityResolver(RestrictiveEntityResolver.INSTANCE);
              SAXSource saxSource = new SAXSource(xmlReader, src);
              _transform(saxSource, out);
          }
          else {
              // for some reason we could not convert source
              // this applies to DOMSource and StAXSource - and possibly 3rd party implementations...
              // a DOMSource can already be compromised as it is parsed by the time it gets to us.
              if (SystemProperties.getBoolean(DISABLED_PROPERTY_NAME)) {
                  LOGGER.log(Level.WARNING,  "XML external entity (XXE) prevention has been disabled by the system " +
                          "property {0}=true Your system may be vulnerable to XXE attacks.", DISABLED_PROPERTY_NAME);
                  if (LOGGER.isLoggable(Level.FINE)) {
                      LOGGER.log(Level.FINE, "Caller stack trace: ", new Exception("XXE Prevention caller history"));
                  }
                  _transform(source, out);
              }
              else {
                  throw new TransformerException("Could not convert source of type " + source.getClass() + " and " +
                          "XXEPrevention is enabled.");
              }
          }
      }