docs: @SuppressWarnings("unchecked")
  	public static <T> T convertToObject(Class<T> clazz, Reader reader) {
  		try {
  			/**
  			 * XXE 漏洞
  			 * https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#JAXB_Unmarshaller
  			 */
  			SAXParserFactory spf = SAXParserFactory.newInstance();
  			spf.setFeature("http://xml.org/sax/features/external-general-entities", false);
  			spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
  			spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
  
  			if (!JAXB_CONTEXT_MAP.containsKey(clazz)) {
  				JAXB_CONTEXT_MAP.put(clazz, JAXBContext.newInstance(clazz));
  			}
  
  			Source xmlSource = new SAXSource(spf.newSAXParser().getXMLReader(), new InputSource(reader));
  			Unmarshaller unmarshaller = JAXB_CONTEXT_MAP.get(clazz).createUnmarshaller();
  			return (T) unmarshaller.unmarshal(xmlSource);
  		} catch (Exception e) {
  			logger.error("", e);
  		}
  		return null;
  	}