title: How to Prevent XML External Entity Injection on TransformerFactory
body: <p><strong>My problem:</strong> </p>
  
  <p>Fortify 4.2.1 is marking below code as susceptible for XML External Entities attack.</p>
  
  <pre><code>TransformerFactory factory = TransformerFactory.newInstance();
  StreamSource xslStream = new StreamSource(inputXSL);
  Transformer transformer = factory.newTransformer(xslStream);
  </code></pre>
  
  <p><strong>Solution I have tried:</strong></p>
  
  <ol>
  <li><p>Setting TransformerFactory feature for <code>XMLConstants.FEATURE_SECURE_PROCESSING</code> to true.</p></li>
  <li><p>Looked into possiblities of providing more such features to TransformerFactory, just like we do for DOM and SAX parsers. e.g. disallowing doctype declaration, etc. But TransformerFactoryImpl doesn't seem to be accepting anything else that <code>XMLConstants.FEATURE_SECURE_PROCESSING</code>. <a href="http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/7-b147/com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java#TransformerFactoryImpl.setFeature%28java.lang.String%2Cboolean%29" rel="noreferrer"> Impl Code </a></p></li>
  </ol>
  
  <p>Please point me to any resource that you think I might have not gone through or a possible solution to this issue.</p>