From: Martin Probst <mail_at_martin-probst.com>
Date: Thu, 9 Jul 2009 14:22:25 +0200

> I think one should generally set
> http://java.sun.com/j2se/1.5.0/docs/api/javax/xml/XMLConstants.html#FEATURE_SECURE_PROCESSING
> to true in the DocumentBuilderFactory when processing XML from the
> outside.

Actually I'm not even sure if that prevents entity expansion
generally. I think one also needs
"factory.setExpandEntityReferences(false);".

Martin