code: public static SAXParser buildSecureSaxParser(InputStream... schemaStream) throws ParserConfigurationException,
              SAXNotRecognizedException, SAXNotSupportedException, SAXException {
          final SAXParserFactory factory = SAXParserFactory.newInstance();
          factory.setNamespaceAware(true);
          factory.setValidating(true);
          factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
          factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
          //setting the following unfortunately breaks reading the old suppression files (version 1).
          //factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
  
          final SAXParser saxParser = factory.newSAXParser();
          saxParser.setProperty(JAXP_SCHEMA_LANGUAGE, W3C_XML_SCHEMA);
          saxParser.setProperty(JAXP_SCHEMA_SOURCE, schemaStream);
          return saxParser;
      }
docs: Constructs a validating secure SAX Parser.
  
  @param schemaStream One or more inputStreams with the schema(s) that the
  parser should be able to validate the XML against, one InputStream per
  schema
  @return a SAX Parser
  @throws javax.xml.parsers.ParserConfigurationException is thrown if there is a parser
  configuration exception
  @throws org.xml.sax.SAXNotRecognizedException thrown if there is an unrecognized
  feature
  @throws org.xml.sax.SAXNotSupportedException thrown if there is a non-supported
  feature
  @throws org.xml.sax.SAXException is thrown if there is a org.xml.sax.SAXException