We released Apache Commons Secure XML to provide secure-by-default JAXP factory creation, abstracting over
implementation-specific XXE securing differences between the stock JDK and external JAXP implementations
(Android, Xalan, Xerces, Woodstox, Saxon-HE) s.apache.org/521yh
