TransformerFactory怎么防xxe注入

Question

TransformerFactory sf = TransformerFactory.newInstance();
sf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
sf.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");

jdk1.8.0_91 运行的时候会抛 IllegalArgumentException ，XMLConstants.ACCESS_EXTERNAL_DTD这个参数不合法 但是owasp上面给的就是 https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#TransformerFactory
要怎么解决

Answer 1

http://blog.csdn.net/scmrpu/article/details/50423701