Secure SAXParserFactory

Author: carlosthe19916

core/src/main/java/io/github/project/openubl/xsender/files/xml/XmlContentProvider.java

@@ -35,13 +35,14 @@ private XmlContentProvider() {
     public static XmlContent getSunatDocument(InputStream is) throws ParserConfigurationException, SAXException, IOException {
         XmlHandler handler = new XmlHandler();
 
-        SAXParserFactory factory = SAXParserFactory.newInstance();
-        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        SAXParserFactory factory = SAXParserFactory.newDefaultInstance();
         factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
         factory.setNamespaceAware(true);
 
         SAXParser parser = factory.newSAXParser();
-        parser.getXMLReader().setFeature("http://xml.org/sax/features/external-general-entities", false);
         parser.parse(is, handler);
 
         return handler.getModel();