SafeXml { public static SAXParserFactory newSaxParserFactory() throws SAXException, ParserConfigurationException { SAXParserFactory factory = SAXParserFactory.newInstance(); factory.setFeature(APACHE_LOAD_EXTERNAL_DTD, false); factory.setFeature(XML_EXTERNAL_GENERAL_ENTITIES, false); factory.setFeature(XML_EXTERNAL_PARAMETER_ENTITIES, false); return factory; } private  SafeXml(); static XMLInputFactory newXmlInputFactory(); static DocumentBuilderFactory newdocumentBuilderFactory(); static DocumentBuilderFactory newStrictDocumentBuilderFactory(); static TransformerFactory newTransformerFactory(); static SAXTransformerFactory newSaxTransformerFactory(); static SAXParserFactory newSaxParserFactory(); static SAXParserFactory newStrictSaxParserFactory();  }
@Test public void testSAXParserFactory() throws ParserConfigurationException, SAXException, IOException { StringBuilder sb = new StringBuilder(); DefaultHandler handler = new DefaultHandler() { @Override public void characters(final char[] ch, final int start, final int length) { sb.append(ch); } }; SafeXml.newSaxParserFactory().newSAXParser().parse(xmlDocument, handler); assertThat(sb.toString(), not(containsString("bar"))); }