public static SAXParserFactory newSecureSAXParserFactory()
          throws SAXException, ParserConfigurationException {
    SAXParserFactory spf = SAXParserFactory.newInstance();
    spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    spf.setFeature(DISALLOW_DOCTYPE_DECL, true);
    spf.setFeature(LOAD_EXTERNAL_DECL, false);
    spf.setFeature(EXTERNAL_GENERAL_ENTITIES, false);
    spf.setFeature(EXTERNAL_PARAMETER_ENTITIES, false);
    return spf;
  }
@Test(expected = SAXException.class)
  public void testExternalDtdWithSecureSAXParserFactory() throws Exception {
    SAXParser parser = XMLUtils.newSecureSAXParserFactory().newSAXParser();
    try (InputStream stream = getResourceStream("/xml/external-dtd.xml")) {
      parser.parse(stream, new DefaultHandler());
    }
  }