code: private void protectAgainstXxeAttacks(final DocumentBuilderFactory dbf) {
      try {
        dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
      } catch (ParserConfigurationException ignored) {
      }
  
      try {
        dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
      } catch (ParserConfigurationException ignored) {
      }
  
      try {
        dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
      } catch (ParserConfigurationException ignored) {
      }
  
      dbf.setXIncludeAware(false);
      dbf.setExpandEntityReferences(false);
    }
docs: Configures the DocumentBuilderFactory in a way, that it is protected against XML External Entity Attacks.
  If the implementing parser does not support one or multiple features, the failed feature is ignored.
  The parser might not protected, if the feature assignment fails.
  
  @see <a href="https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet">OWASP Information of XXE attacks</a>
  
  @param dbf The factory to configure.