code: public static void applyXXEProtection(DocumentBuilderFactory factory) {
  		Map<String, Boolean> features = new HashMap<String, Boolean>();
  		features.put("http://apache.org/xml/features/disallow-doctype-decl", true);
  		features.put("http://xml.org/sax/features/external-general-entities", false);
  		features.put("http://xml.org/sax/features/external-parameter-entities", false);
  		features.put("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
  
  		for (Map.Entry<String, Boolean> entry : features.entrySet()) {
  			String feature = entry.getKey();
  			Boolean value = entry.getValue();
  			try {
  				factory.setFeature(feature, value);
  			} catch (ParserConfigurationException e) {
  				//feature is not supported by the local XML engine, skip it
  			}
  		}
  
  		factory.setXIncludeAware(false);
  		factory.setExpandEntityReferences(false);
  	}
docs: Configures a {@link DocumentBuilderFactory} to protect it against XML
  External Entity attacks.
  @param factory the factory
  @see <a href=
  "https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Prevention_Cheat_Sheet#Java">
  XXE Cheat Sheet</a>