public GraphMLReader create() {
            if (this.inputFactory == null) {
                this.inputFactory = XMLInputFactory.newInstance();

                // prevent XXE
                // https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing
                inputFactory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
                inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
            }
            return new GraphMLReader(this);
        }
A custom {@code XMLInputFactory}. If this value is not set then a default one is constructed. The default
will be configured to disable DTDs and support of external entities to prevent
<a href="https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser">XXE</a>
style attacks.
gremlin-core/src/main/java/org/apache/tinkerpop/gremlin/structure/io/graphml/GraphMLReader.java