private static SAXReader constructNewReader() throws SAXException
    {
        final SAXReader saxReader = new SAXReader();
        saxReader.setEncoding( "UTF-8" );
        saxReader.setIgnoreComments(true);

        // Guard against various known vulnerabilities (see OF-2094).
        saxReader.setEntityResolver((publicId, systemId) -> {
            throw new IOException("External entity denied: " + publicId + " // " + systemId);
        });
        saxReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
        saxReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        saxReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
        saxReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

        return saxReader;
    }
Constructs a new SAXReader instance, configured for XMPP parsing.

@return A new SAXReader instance.
xmppserver/src/main/java/org/jivesoftware/util/SAXReaderUtil.java