code: private String getActiveArquillianHost(final URL arquillianXml, final String arquillianLaunch) {
  
          final XPath xPath = XPathFactory.newInstance().newXPath();
          final String xpExpr = "//container[@qualifier=$containerQualifier]/protocol/property[@name='host']";
          try {
              final Document document = parseDocument(arquillianXml);
  
              //SCRIB-23 adding a variable resolver that returns only sanitized input values
              xPath.setXPathVariableResolver(new ArquillianLaunchVariableResolver(arquillianLaunch));
              // with the sanity check the already unlikely chance of maliciously injecting statements into
              // the xpath expression becomes impossible. As the sonar rule still indicating this as
              // an error, the NOSONAR marker is set
              return xPath.evaluate(xpExpr, document);//NOSONAR
          } catch (SAXException | IOException | ParserConfigurationException e) {
              LOG.error("Could not parse arquilian.xml", e);
              throw new AssertionError("Could not parse arquilian.xml:" + e.getMessage(), e);
          } catch (final XPathExpressionException e) {
              LOG.error("Could evaluate {}", xpExpr, e);
              throw new AssertionError("Could evaluate " + xpExpr + ":" + e.getMessage(), e);
          }
      }
docs: Reads the active remote host from the <code>arquillian.xml</code>. The host is activated by the defining
  container which is activated by its qualified using the <code>arquillian.launch</code> system property. If there
  is no host defined, <code>null</code> is returned indicating to use the default configuration.
  
  @param arquillianXml
  the URL of the arquillian.xml file
  @param arquillianLaunch
  the launch container qualifier. The qualifier may consist of alphanumeric characters only.
  
  @return the name of the remote host or <code>null</code> if none is defined