sigh.java

// ...
    /**
     * Get an DocumentBuilder that is protected from entity injection.
     * @return new DocumenBuilder
     * @throws ParserConfigurationException when it feels like being peak java
     */
    public DocumentBuilder newDocumentBuilder() throws ParserConfigurationException {
        final var df = DocumentBuilderFactory.newInstance();
        df.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
        df.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
        return df.newDocumentBuilder();
    }
// ...