code: public static DocumentBuilder xmls() throws ParserConfigurationException {
          DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
          String FEATURE = null;
          
          // This is the PRIMARY defense. If DTDs (doctypes) are disallowed, almost all XML entity attacks are prevented
          // Xerces 2 only - http://xerces.apache.org/xerces2-j/features.html#disallow-doctype-decl
  
          FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
          dbf.setFeature(FEATURE, true);
  
          // If you can't completely disable DTDs, then at least do the following:
          // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-general-entities
  
          // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-general-entities
  
          // JDK7+ - http://xml.org/sax/features/external-general-entities 
          FEATURE = "http://xml.org/sax/features/external-general-entities";
          dbf.setFeature(FEATURE, false);
  
          // Xerces 1 - http://xerces.apache.org/xerces-j/features.html#external-parameter-entities
  
          // Xerces 2 - http://xerces.apache.org/xerces2-j/features.html#external-parameter-entities
  
          // JDK7+ - http://xml.org/sax/features/external-parameter-entities 
          FEATURE = "http://xml.org/sax/features/external-parameter-entities";
          dbf.setFeature(FEATURE, false);
  
          // Disable external DTDs as well
          FEATURE = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
          dbf.setFeature(FEATURE, false);
  
          // and these as well, per Timothy Morgan's 2014 paper: "XML Schema, DTD, and Entity Attacks"
          dbf.setXIncludeAware(false);
          dbf.setExpandEntityReferences(false);
          return dbf.newDocumentBuilder();
      }
docs: 帮你快速获得一个 DocumentBuilder，方便 XML 解析。
  
  @return 一个 DocumentBuilder 对象
  @throws ParserConfigurationException