We just released Apache Commons Secure XML to provide secure-by-default JAXP factory creation, abstracting over implementation-specific XXE securing differences between the stock JDK and external JAXP implementations (Android, Apache Xalan, Apache Xerces, Woodstox, Saxon-HE) s.apache.org/521yh
Apache Commons Secure XML – Apache Commons Secure XML
commons.apache.org