code: private static Source createSafeSource(XMLReader reader, InputSource source) {
          try {
              reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
          } catch (SAXException ignored) {
              /* Fallback entity resolver will be used */
          }
          try {
              reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
          } catch (SAXException ignored) {
              /* Fallback entity resolver will be used */
          }
           // Fallback in case the above features are not supported by the underlying XML library.
          reader.setEntityResolver((publicId, systemId) -> {
              return new InputSource(new ByteArrayInputStream(XXE_MARKER.getBytes(StandardCharsets.US_ASCII)));
          });
          return new SAXSource(reader, source);
      }
docs: Converts a Source into a Source that is protected against XXE attacks.
  @see jenkins.util.xml.XMLUtils#safeTransform