  protected void configureReader(XMLReader reader, DefaultHandler handler)
          throws DocumentException {
    // configure lexical handling
    SAXHelper.setParserProperty(reader, SAX_LEXICALHANDLER, handler);

    // try alternate property just in case
    SAXHelper.setParserProperty(reader, SAX_LEXICAL_HANDLER, handler);

    // register the DeclHandler
    if (includeInternalDTDDeclarations || includeExternalDTDDeclarations) {
      SAXHelper.setParserProperty(reader, SAX_DECL_HANDLER, handler);
    }

    // string interning
    SAXHelper.setParserFeature(reader, SAX_STRING_INTERNING,
            isStringInternEnabled());

    try {
      // configure validation support
      reader.setFeature("http://xml.org/sax/features/validation",
              isValidating());

      if (errorHandler != null) {
        reader.setErrorHandler(errorHandler);
      } else {
        reader.setErrorHandler(handler);
      }
    } catch (Exception e) {
      if (isValidating()) {
        throw new DocumentException("Validation not supported for"
                + " XMLReader: " + reader, e);
      }
    }
  }
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.