public static SAXBuilder createSecureSAXBuilder(boolean validate, boolean needsDTD) {
		final String IMPLNAME = "com.sun.org.apache.xerces.internal.parsers.SAXParser";
		SAXBuilder sax = new SAXBuilder(IMPLNAME, validate);
		sax.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
		// XML Program Import uses DTD
		if (!needsDTD) {
			sax.setFeature(FEATURE_DISALLOW_DTD, true);
		}
		sax.setFeature(FEATURE_EXTERNAL_GENERAL_ENTITIES, false);
		sax.setFeature(FEATURE_EXTERNAL_PARAMETER_ENTITIES, false);
		return sax;
	}
Create a {@link SAXBuilder} that is not susceptible to XXE.

This configures the builder to ignore external entities.

@param validate indicates whether validation should occur
@param needsDTD false to disable doctype declarations altogether
@return the configured builder
Ghidra/Framework/Generic/src/main/java/ghidra/util/xml/XmlUtilities.java