diff --git a/nbbuild/antsrc/org/netbeans/nbbuild/MakeNBM.java b/nbbuild/antsrc/org/netbeans/nbbuild/MakeNBM.java
index 0aa4de046e54..88f9be0ef667 100644
--- a/nbbuild/antsrc/org/netbeans/nbbuild/MakeNBM.java
+++ b/nbbuild/antsrc/org/netbeans/nbbuild/MakeNBM.java
@@ -31,7 +31,6 @@
 import java.io.OutputStream;
 import java.io.UnsupportedEncodingException;
 import java.net.URI;
-import java.net.URL;
 import java.text.SimpleDateFormat;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -65,7 +64,6 @@
 import org.apache.tools.ant.taskdefs.ExecTask;
 import org.apache.tools.ant.taskdefs.Jar;
 import org.apache.tools.ant.taskdefs.SignJar;
-import org.apache.tools.ant.types.Commandline;
 import org.apache.tools.ant.types.FileSet;
 import org.apache.tools.ant.types.Path;
 import org.apache.tools.ant.types.ZipFileSet;
@@ -1102,13 +1100,16 @@ private void maybeAddLicense(Element module) {
     static void validateAgainstAUDTDs(InputSource input, final Path updaterJar, final Task task) throws IOException, SAXException {
         XMLUtil.parse(input, true, false, XMLUtil.rethrowHandler(), new EntityResolver() {
             ClassLoader loader = new AntClassLoader(task.getProject(), updaterJar);
+            @Override
             public InputSource resolveEntity(String publicId, String systemId) throws SAXException, IOException {
                 String remote = "http://www.netbeans.org/dtds/";
                 if (systemId.startsWith(remote)) {
                     String rsrc = "org/netbeans/updater/resources/" + systemId.substring(remote.length());
-                    URL u = loader.getResource(rsrc);
-                    if (u != null) {
-                        return new InputSource(u.toString());
+                    InputStream entity = loader.getResourceAsStream(rsrc);
+                    if (entity != null) {
+                        try (entity) {
+                            return new InputSource(new ByteArrayInputStream(entity.readAllBytes()));
+                        }
                     } else {
                         task.log(rsrc + " not found in " + updaterJar, Project.MSG_WARN);
                     }
diff --git a/nbbuild/antsrc/org/netbeans/nbbuild/XMLUtil.java b/nbbuild/antsrc/org/netbeans/nbbuild/XMLUtil.java
index ab96e71eea1d..25576cdd13fd 100644
--- a/nbbuild/antsrc/org/netbeans/nbbuild/XMLUtil.java
+++ b/nbbuild/antsrc/org/netbeans/nbbuild/XMLUtil.java
@@ -26,6 +26,7 @@
 import java.io.StringReader;
 import java.util.ArrayList;
 import java.util.List;
+import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
@@ -87,6 +88,7 @@ public static Document parse (
             factory.setNamespaceAware(namespaceAware);
 
             try {
+                factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
                 builder = factory.newDocumentBuilder();
             } catch (ParserConfigurationException ex) {
                 throw new SAXException(ex);
@@ -127,6 +129,7 @@ public static EntityResolver nullResolver() {
     public static Document createDocument(String rootQName) throws DOMException {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         try {
+            factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
             return factory.newDocumentBuilder().getDOMImplementation().createDocument(null, rootQName, null);
         } catch (ParserConfigurationException ex) {
             throw (DOMException)new DOMException(DOMException.NOT_SUPPORTED_ERR, "Cannot create parser").initCause(ex); // NOI18N