title: XML parser configured here does not prevent nor limit external entities resolution
body: <p>When I run HP Fortify on this program:</p>
  
  <pre><code>    DOMSource domSource = new DOMSource(document);
      ByteArrayOutputStream bos=new ByteArrayOutputStream();
  
      StreamResult result = new StreamResult(bos);
      TransformerFactory tf = TransformerFactory.newInstance();
      Transformer transformer;
      try {
          transformer = tf.newTransformer();
          transformer.transform(domSource, result);
      } catch (TransformerException e) {
          // TODO Auto-generated catch block
          e.printStackTrace();
      }
  </code></pre>
  
  <p>I obtain this error:</p>
  
  <blockquote>
    <p>XML parser configured in ItemServlet.java:92 does not prevent nor limit external entities resolution. This can expose the parser to an XML External Entities attack.</p>
  </blockquote>
  
  <p>According to this <a href="https://blog.csnc.ch/2012/08/secure-xml-parser-configuration/" rel="nofollow">blog</a>, the following features should be set.</p>
  
  <pre><code>tf.setFeature("http://xml.org/sax/features/external-general-entities", false);
  tf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
  </code></pre>
  
  <p>But the problem is that my <code>TransformerFactory</code> instance does not support this method.</p>