code: public static void applyXXEProtection(TransformerFactory factory) {
  		//@formatter:off
  		String[] attributes = {
  			//XMLConstants.ACCESS_EXTERNAL_DTD (Java 7 only)
  			"http://javax.xml.XMLConstants/property/accessExternalDTD",
  
  			//XMLConstants.ACCESS_EXTERNAL_STYLESHEET (Java 7 only)
  			"http://javax.xml.XMLConstants/property/accessExternalStylesheet"
  		};
  		//@formatter:on
  
  		for (String attribute : attributes) {
  			try {
  				factory.setAttribute(attribute, "");
  			} catch (IllegalArgumentException e) {
  				//attribute is not supported by the local XML engine, skip it
  			}
  		}
  	}
docs: Configures a {@link TransformerFactory} to protect it against XML
  External Entity attacks.
  @param factory the factory
  @see <a href=
  "https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Prevention_Cheat_Sheet#Java">
  XXE Cheat Sheet</a>