private void validateXmlFeatures(ApplicationPackage applicationPackage, DeployLogger logger) {
            // TODO: Validate no use of XInclude, datatype definitions or external entities
            //       in any xml file we parse, such as services.xml, deployment.xml, hosts.xml,
            //       validation-overrides.xml and any pom.xml files in OSGi bundles
            //       services.xml and hosts.xml will need to be preprocessed by our own processors first

            File applicationPackageDir = applicationPackage.getFileReference(Path.fromString("."));
            File servicesXml = applicationPackage.getFileReference(Path.fromString("services.xml"));
            File hostsXml = applicationPackage.getFileReference(Path.fromString("hosts.xml"));

            // Validate after doing our own preprocessing on these two files
            ApplicationMetaData meta = applicationPackage.getMetaData();
            InstanceName instance = meta.getApplicationId().instance();
            Tags tags = applicationPackage.getDeploymentSpec().tags(instance, zone.environment());
            if (servicesXml.exists()) {
                vespaPreprocess(applicationPackageDir.getAbsoluteFile(), servicesXml, meta, tags);
            }
            if (hostsXml.exists()) {
                vespaPreprocess(applicationPackageDir.getAbsoluteFile(), hostsXml, meta, tags);
            }

            // Validate pom.xml files in OSGi bundles
            try (var paths = Files.find(applicationPackageDir.getAbsoluteFile().toPath(), Integer.MAX_VALUE,
                    (path, attr) -> attr.isRegularFile() && path.getFileName().toString().matches(".*\\.[Jj][Aa][Rr]"))) {
                        paths.forEach(jarPath -> {
                            try {
                                new BundleValidator().getPomXmlContent((msg, cause) -> { throw new IllegalArgumentException(msg, cause); },
                                                                       logger, new JarFile(jarPath.toFile())).ifPresent(pom -> {
                                    try {
                                        new ValidationProcessor().process(pom);
                                    }
                                    catch (IOException | TransformerException e) {
                                        throw new RuntimeException(e);
                                    }
                                });
                            } catch (ZipException e) {
                                // ignore for tests
                            } catch (IOException e) {
                                throw new RuntimeException(e);
                            }
                        });
            } catch (IOException e) {
                throw new RuntimeException(e);
            }
        }
Warn on use of deprecated XML features
configserver/src/main/java/com/yahoo/vespa/config/server/session/SessionPreparer.java