code: public static XMLInputFactory createXMLInputFactory(boolean nsAware)
     {
        XMLInputFactory factory = XMLInputFactory.newInstance();
        factory.setProperty(XMLInputFactory.IS_NAMESPACE_AWARE, nsAware);
        factory.setProperty(XMLInputFactory.SUPPORT_DTD, Boolean.FALSE);
        factory.setProperty(XMLInputFactory.IS_REPLACING_ENTITY_REFERENCES, Boolean.FALSE);
        factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, Boolean.FALSE);
        factory.setXMLResolver(new XMLResolver()
        {
           public Object resolveEntity(String publicID, String systemID, String baseURI, String namespace)
                 throws XMLStreamException
           {
              throw Messages.MESSAGES.readingExternalEntitiesDisabled();
           }
        });
        return factory;
     }
docs: Return a new factory so that the caller can set sticky parameters.
  @param nsAware  true is nsAware
  @return  XMLInputFactory