public static SAXParserFactory createSecureSAXParserFactory(boolean needsDTD) {
		SAXParserFactory factory = SAXParserFactory.newInstance();
		try {
			factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
			// XML Program Import uses DTD
			if (!needsDTD) {
				factory.setFeature(FEATURE_DISALLOW_DTD, true);
			}
			factory.setFeature(FEATURE_EXTERNAL_GENERAL_ENTITIES, false);
			factory.setFeature(FEATURE_EXTERNAL_PARAMETER_ENTITIES, false);
		}
		catch (SAXNotRecognizedException | SAXNotSupportedException
				| ParserConfigurationException e) {
			throw new RuntimeException("Cannot set XML parsing feature for secure processing: ", e);
		}
		return factory;
	}
Create a {@link SAXParserFactory} that is not susceptible to XXE.

This configures the factory to ignore external entities.

@param needsDTD false to disable doctype declarations altogether
@return the configured factory
Ghidra/Framework/Generic/src/main/java/ghidra/util/xml/XmlUtilities.java