code: private XMLInputFactory factory() {
          XMLInputFactory factory = XMLInputFactory.newInstance();
          factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
          factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
          return factory;
      }
docs: Creates the factory.
  <p>
  Recreated each time to avoid JDK-8028111.
  
  @return the factory, not null