SWS-1049 - Replace direct API usage with better defaults.

spring-xml/src/main/java/org/springframework/xml/DocumentBuilderFactoryUtils.java

@@ -0,0 +1,100 @@
+/*
+ * Copyright 2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.xml;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * @author Greg Turnquist
+ * @since 3.0.5
+ */
+public class DocumentBuilderFactoryUtils {
+
+	private static final Log log = LogFactory.getLog(DocumentBuilderFactoryUtils.class);
+
+	/**
+	 * Build a {@link DocumentBuilderFactory} then set properties to prevent external entity access.
+	 *
+	 * @see DocumentBuilderFactory#newInstance()
+	 */
+	public static DocumentBuilderFactory newInstance() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+
+		try {
+			factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+		} catch (IllegalArgumentException e) {
+			if (log.isWarnEnabled()) {
+				log.warn(XMLConstants.ACCESS_EXTERNAL_DTD + " property not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+		} catch (IllegalArgumentException e) {
+			if (log.isWarnEnabled()) {
+				log.warn(XMLConstants.ACCESS_EXTERNAL_SCHEMA + " property not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+		} catch (ParserConfigurationException e) {
+			if (log.isWarnEnabled()) {
+				log.warn("FEATURE 'http://apache.org/xml/features/disallow-doctype-decl' is probably not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+		} catch (ParserConfigurationException e) {
+			if (log.isWarnEnabled()) {
+				log.warn("FEATURE 'http://xml.org/sax/features/external-general-entities' is probably not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+		} catch (ParserConfigurationException e) {
+			if (log.isWarnEnabled()) {
+				log.warn("FEATURE 'http://xml.org/sax/features/external-parameter-entities' is probably not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+		} catch (ParserConfigurationException e) {
+			if (log.isWarnEnabled()) {
+				log.warn("FEATURE 'http://apache.org/xml/features/nonvalidating/load-external-dtd' is probably not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setXIncludeAware(false);
+			factory.setExpandEntityReferences(false);
+		} catch (Exception e) {
+			if (log.isWarnEnabled()) {
+				log.warn("Caught " + e.getMessage() + " attempting to configure your XML parser.");
+			}
+		}
+
+		return factory;
+	}
+}

spring-xml/src/main/java/org/springframework/xml/JaxpVersion.java

@@ -22,12 +22,11 @@ import org.springframework.util.ClassUtils;
  * Helper class used to find the current version of JAXP. We cannot depend on the Java version, since JAXP can be
  * upgraded independently of the Java version.
  *
- * <p>Only distinguishes between JAXP 1.0, 1.1, 1.3, and 1.4, since JAXP 1.2 was a maintenance release with no new
+ * <p>Only distinguishes between JAXP 1.0, 1.1, 1.3, 1.4, and 1.5, since JAXP 1.2 was a maintenance release with no new
  * classes.
  *
- * <p>Note that Spring-WS requires JDK 1.5 as of Spring-WS 2.0, and therefore has at least JAXP 1.3 available.
- *
  * @author Arjen Poutsma
+ * @author Greg Turnquist
  * @since 1.0.0
  */
 public abstract class JaxpVersion {
@@ -52,19 +51,31 @@ public abstract class JaxpVersion {
 	 */
 	public static final int JAXP_14 = 4;
 
+	/**
+	 * Constant identifying JAXP 1.5.
+	 */
+	public static final int JAXP_15 = 5;
+
 	private static final String JAXP_14_CLASS_NAME = "javax.xml.transform.stax.StAXSource";
+	
+	private static final String JAXP_15_CLASS_NAME = "javax.xml.validation.SchemaFactoryConfigurationError";
 
 	private static int jaxpVersion;
 
 	static {
 		ClassLoader classLoader = JaxpVersion.class.getClassLoader();
+
 		try {
-			ClassUtils.forName(JAXP_14_CLASS_NAME, classLoader);
-			jaxpVersion = JAXP_14;
-		}
-		catch (ClassNotFoundException ex) {
-			// leave 1.3 as default (it's either 1.3 or unknown)
-			jaxpVersion = JAXP_13;
+			ClassUtils.forName(JAXP_15_CLASS_NAME, classLoader);
+			jaxpVersion = JAXP_15;
+		} catch (ClassNotFoundException ex) {
+			try {
+				ClassUtils.forName(JAXP_14_CLASS_NAME, classLoader);
+				jaxpVersion = JAXP_14;
+			} catch (ClassNotFoundException e) {
+				// leave 1.3 as default (it's either 1.3 or unknown)
+				jaxpVersion = JAXP_13;
+			}
 		}
 	}
 
@@ -76,6 +87,7 @@ public abstract class JaxpVersion {
 	 * @see #JAXP_11
 	 * @see #JAXP_13
 	 * @see #JAXP_14
+	 * @see #JAXP_15
 	 */
 	public static int getJaxpVersion() {
 		return jaxpVersion;

spring-xml/src/main/java/org/springframework/xml/XMLInputFactoryUtils.java

@@ -0,0 +1,39 @@
+/*
+ * Copyright 2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.xml;
+
+import javax.xml.stream.XMLInputFactory;
+
+/**
+ * @author Greg Turnquist
+ */
+public class XMLInputFactoryUtils {
+
+	/**
+	 * Build an {@link XMLInputFactory} and set properties to prevent external entities from accessing.
+	 *
+	 * @see XMLInputFactory#newInstance() 
+	 */
+	public static XMLInputFactory newInstance() {
+		XMLInputFactory factory = XMLInputFactory.newInstance();
+
+		factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+		factory.setProperty("javax.xml.stream.isSupportingExternalEntities", false);
+		
+		return factory;
+	}
+
+}

spring-xml/src/main/java/org/springframework/xml/transform/TransformerFactoryUtils.java

@@ -0,0 +1,60 @@
+/*
+ * Copyright 2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.xml.transform;
+
+import javax.xml.XMLConstants;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.TransformerFactoryConfigurationError;
+
+/**
+ * @author Greg Turnquist
+ * @since 3.0.5
+ */
+public class TransformerFactoryUtils {
+
+	/**
+	 * Build a new {@link TransformerFactory} using the default constructor.
+	 */
+	public static TransformerFactory newInstance() {
+		return defaultSettings(TransformerFactory.newInstance());
+	}
+
+	/**
+	 * Build an {@link TransformerFactory} and prevent external entities from accessing.
+	 *
+	 * @see TransformerFactory#newInstance()
+	 */
+	public static TransformerFactory newInstance(Class<? extends TransformerFactory> transformerFactoryClass) {
+		try {
+			return defaultSettings(transformerFactoryClass.newInstance());
+		} catch (InstantiationException e) {
+			throw new TransformerFactoryConfigurationError(e,
+					"Could not instantiate TransformerFactory [" + transformerFactoryClass + "]");
+		} catch (IllegalAccessException e) {
+			throw new TransformerFactoryConfigurationError(e,
+					"Could not instantiate TransformerFactory [" + transformerFactoryClass + "]");
+		}
+	}
+
+	/**
+	 * Prevent external entities from accessing.
+	 */
+	private static TransformerFactory defaultSettings(TransformerFactory factory) {
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+		return factory;
+	}
+}

spring-xml/src/main/java/org/springframework/xml/transform/TransformerHelper.java

@@ -22,7 +22,6 @@ import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerConfigurationException;
 import javax.xml.transform.TransformerException;
 import javax.xml.transform.TransformerFactory;
-import javax.xml.transform.TransformerFactoryConfigurationError;
 
 import org.springframework.util.Assert;
 
@@ -83,16 +82,11 @@ public class TransformerHelper {
 	 */
 	protected TransformerFactory newTransformerFactory(Class<? extends TransformerFactory> transformerFactoryClass) {
 		if (transformerFactoryClass != null) {
-			try {
-				return transformerFactoryClass.newInstance();
-			}
-			catch (Exception ex) {
-				throw new TransformerFactoryConfigurationError(ex,
-						"Could not instantiate TransformerFactory [" + transformerFactoryClass + "]");
-			}
-		}
-		else {
-			return TransformerFactory.newInstance();
+			TransformerFactory transformerFactory = TransformerFactoryUtils.newInstance(transformerFactoryClass);
+			return transformerFactory;
+		} else {
+			TransformerFactory transformerFactory = TransformerFactoryUtils.newInstance();
+			return transformerFactory;
 		}
 	}
 

spring-xml/src/main/java/org/springframework/xml/validation/Jaxp13ValidatorFactory.java

@@ -32,6 +32,7 @@ import org.springframework.core.io.Resource;
  * Internal class that uses JAXP 1.0 features to create {@code XmlValidator} instances.
  *
  * @author Arjen Poutsma
+ * @author Greg Turnquist
  * @since 1.0.0
  */
 abstract class Jaxp13ValidatorFactory {

spring-xml/src/main/java/org/springframework/xml/validation/Jaxp15ValidatorFactory.java

@@ -0,0 +1,138 @@
+/*
+ * Copyright 2005-2014 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.xml.validation;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import javax.xml.XMLConstants;
+import javax.xml.transform.Source;
+import javax.xml.validation.Schema;
+import javax.xml.validation.Validator;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+import org.xml.sax.SAXParseException;
+
+import org.springframework.core.io.Resource;
+
+/**
+ * Internal class that uses JAXP 1.5 features to create an {@code XmlValidator} with settings to prevent
+ * external entity access.
+ *
+ * @author Arjen Poutsma
+ * @author Greg Turnquist
+ * @since 3.0.5
+ */
+abstract class Jaxp15ValidatorFactory {
+
+	private static final Log log = LogFactory.getLog(Jaxp15ValidatorFactory.class);
+
+
+	static XmlValidator createValidator(Resource[] resources, String schemaLanguage) throws IOException {
+		try {
+			Schema schema = SchemaLoaderUtils.loadSchema(resources, schemaLanguage);
+			return new Jaxp15Validator(schema);
+		}
+		catch (SAXException ex) {
+			throw new XmlValidationException("Could not create Schema: " + ex.getMessage(), ex);
+		}
+	}
+
+	private static class Jaxp15Validator implements XmlValidator {
+
+		private Schema schema;
+
+		public Jaxp15Validator(Schema schema) {
+			this.schema = schema;
+		}
+
+		@Override
+		public SAXParseException[] validate(Source source) throws IOException {
+			return validate(source, null);
+		}
+
+		@Override
+		public SAXParseException[] validate(Source source, ValidationErrorHandler errorHandler) throws IOException {
+			if (errorHandler == null) {
+				errorHandler = new DefaultValidationErrorHandler();
+			}
+			Validator validator = schema.newValidator();
+
+			try {
+				validator.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+			} catch (SAXNotRecognizedException e) {
+				if (log.isWarnEnabled()) {
+					log.warn(XMLConstants.ACCESS_EXTERNAL_DTD + " property not supported by " + validator.getClass().getCanonicalName());
+				}
+			} catch (SAXNotSupportedException e) {
+				if (log.isWarnEnabled()) {
+					log.warn(XMLConstants.ACCESS_EXTERNAL_DTD + " property not supported by " + validator.getClass().getCanonicalName());
+				}
+			}
+
+			try {
+				validator.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+			} catch (SAXNotRecognizedException e) {
+				if (log.isWarnEnabled()) {
+					log.warn(XMLConstants.ACCESS_EXTERNAL_SCHEMA + " property not supported by " + validator.getClass().getCanonicalName());
+				}
+			} catch (SAXNotSupportedException e) {
+				if (log.isWarnEnabled()) {
+					log.warn(XMLConstants.ACCESS_EXTERNAL_SCHEMA + " property not supported by " + validator.getClass().getCanonicalName());
+				}
+			}
+
+			validator.setErrorHandler(errorHandler);
+			try {
+				validator.validate(source);
+				return errorHandler.getErrors();
+			}
+			catch (SAXException ex) {
+				throw new XmlValidationException("Could not validate source: " + ex.getMessage(), ex);
+			}
+		}
+	}
+
+	/** {@code ErrorHandler} implementation that stores errors and fatal errors in a list. */
+	private static class DefaultValidationErrorHandler implements ValidationErrorHandler {
+
+		private List<SAXParseException> errors = new ArrayList<SAXParseException>();
+
+		@Override
+		public SAXParseException[] getErrors() {
+			return errors.toArray(new SAXParseException[errors.size()]);
+		}
+
+		@Override
+		public void warning(SAXParseException ex) throws SAXException {
+		}
+
+		@Override
+		public void error(SAXParseException ex) throws SAXException {
+			errors.add(ex);
+		}
+
+		@Override
+		public void fatalError(SAXParseException ex) throws SAXException {
+			errors.add(ex);
+		}
+	}
+}

spring-xml/src/main/java/org/springframework/xml/validation/SchemaFactoryUtils.java

@@ -0,0 +1,70 @@
+/*
+ * Copyright 2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.xml.validation;
+
+import javax.xml.XMLConstants;
+import javax.xml.validation.SchemaFactory;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+
+/**
+ * @author Greg Turnquist
+ * @since 3.0.5
+ */
+public class SchemaFactoryUtils {
+
+	private static final Log log = LogFactory.getLog(SchemaFactoryUtils.class);
+
+	/**
+	 * Build a {@link SchemaFactory} and set properties to prevent external entities from accessing.
+	 *
+	 * @see SchemaFactory#newInstance(String) 
+	 */
+	public static SchemaFactory newInstance(String schemaLanguage) {
+		SchemaFactory schemaFactory = SchemaFactory.newInstance(schemaLanguage);
+
+		try {
+			schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+		} catch (SAXNotRecognizedException e) {
+			if (log.isWarnEnabled()) {
+				log.warn(XMLConstants.ACCESS_EXTERNAL_DTD + " property not supported by " + schemaFactory.getClass().getCanonicalName());
+			}
+
+		} catch (SAXNotSupportedException e) {
+			if (log.isWarnEnabled()) {
+				log.warn(XMLConstants.ACCESS_EXTERNAL_DTD + " property not supported by " + schemaFactory.getClass().getCanonicalName());
+			}
+
+		}
+
+		try {
+			schemaFactory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "file,jar:file");
+		} catch (SAXNotRecognizedException e) {
+			if (log.isWarnEnabled()) {
+				log.warn(XMLConstants.ACCESS_EXTERNAL_SCHEMA + " property not supported by " + schemaFactory.getClass().getCanonicalName());
+			}
+		} catch (SAXNotSupportedException e) {
+			if (log.isWarnEnabled()) {
+				log.warn(XMLConstants.ACCESS_EXTERNAL_SCHEMA + " property not supported by " + schemaFactory.getClass().getCanonicalName());
+			}
+		}
+
+		return schemaFactory;
+	}
+}

spring-xml/src/main/java/org/springframework/xml/validation/SchemaLoaderUtils.java

@@ -21,14 +21,13 @@ import javax.xml.transform.Source;
 import javax.xml.validation.Schema;
 import javax.xml.validation.SchemaFactory;
 
+import org.xml.sax.SAXException;
+import org.xml.sax.XMLReader;
+
 import org.springframework.core.io.Resource;
 import org.springframework.util.Assert;
 import org.springframework.xml.transform.ResourceSource;
 
-import org.xml.sax.SAXException;
-import org.xml.sax.XMLReader;
-import org.xml.sax.helpers.XMLReaderFactory;
-
 /**
  * Convenient utility methods for loading of {@link Schema} objects, performing standard handling of input streams.
  *
@@ -67,14 +66,14 @@ public abstract class SchemaLoaderUtils {
 		Assert.notEmpty(resources, "No resources given");
 		Assert.hasLength(schemaLanguage, "No schema language provided");
 		Source[] schemaSources = new Source[resources.length];
-		XMLReader xmlReader = XMLReaderFactory.createXMLReader();
+		XMLReader xmlReader = XMLReaderFactoryUtils.createXMLReader();
 		xmlReader.setFeature("http://xml.org/sax/features/namespace-prefixes", true);
 		for (int i = 0; i < resources.length; i++) {
 			Assert.notNull(resources[i], "Resource is null");
 			Assert.isTrue(resources[i].exists(), "Resource " + resources[i] + " does not exist");
 			schemaSources[i] = new ResourceSource(xmlReader, resources[i]);
 		}
-		SchemaFactory schemaFactory = SchemaFactory.newInstance(schemaLanguage);
+		SchemaFactory schemaFactory = SchemaFactoryUtils.newInstance(schemaLanguage);
 		return schemaFactory.newSchema(schemaSources);
 	}
 
@@ -87,4 +86,5 @@ public abstract class SchemaLoaderUtils {
 			return null;
 		}
 	}
+
 }

spring-xml/src/main/java/org/springframework/xml/validation/XMLReaderFactoryUtils.java

@@ -0,0 +1,43 @@
+/*
+ * Copyright 2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.xml.validation;
+
+import org.xml.sax.SAXException;
+import org.xml.sax.XMLReader;
+import org.xml.sax.helpers.XMLReaderFactory;
+
+/**
+ * @author Greg Turnquist
+ * @since 3.0.5
+ */
+public class XMLReaderFactoryUtils {
+
+	/**
+	 * Build a {@link XMLReader} and set properties to prevent external entity access.
+	 *
+	 * @see XMLReaderFactory#createXMLReader() 
+	 */
+	public static XMLReader createXMLReader() throws SAXException {
+		XMLReader xmlReader = XMLReaderFactory.createXMLReader();
+
+		xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+		xmlReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+		xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+		xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+
+		return xmlReader;
+	}
+}

spring-xml/src/main/java/org/springframework/xml/validation/XmlValidatorFactory.java

@@ -19,13 +19,13 @@ package org.springframework.xml.validation;
 import java.io.IOException;
 import javax.xml.validation.Validator;
 
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
 import org.springframework.core.io.Resource;
 import org.springframework.util.Assert;
 import org.springframework.xml.JaxpVersion;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
 /**
  * Factory for {@link XmlValidator} objects, being aware of JAXP 1.3 {@link Validator}s, and JAXP 1.0 parsing
  * capabilities. Mainly for internal use within the framework.
@@ -84,10 +84,15 @@ public abstract class XmlValidatorFactory {
 		Assert.hasLength(schemaLanguage, "No schema language provided");
 		Assert.isTrue(SCHEMA_W3C_XML.equals(schemaLanguage) || SCHEMA_RELAX_NG.equals(schemaLanguage),
 				"Invalid schema language: " + schemaLanguage);
+		Assert.noNullElements(schemaResources, "No null schemaResources allowed");
 		for (Resource schemaResource : schemaResources) {
 			Assert.isTrue(schemaResource.exists(), "schema [" + schemaResource + "] does not exist");
 		}
-		if (JaxpVersion.getJaxpVersion() >= JaxpVersion.JAXP_13) {
+		if (JaxpVersion.getJaxpVersion() >= JaxpVersion.JAXP_15) {
+			logger.trace("Creating JAXP 1.5 XmlValidator");
+			return Jaxp15ValidatorFactory.createValidator(schemaResources, schemaLanguage);
+		}
+		else if (JaxpVersion.getJaxpVersion() >= JaxpVersion.JAXP_13) {
 			logger.trace("Creating JAXP 1.3 XmlValidator");
 			return Jaxp13ValidatorFactory.createValidator(schemaResources, schemaLanguage);
 		}

spring-xml/src/main/java/org/springframework/xml/xsd/DocumentBuilderFactoryUtils.java

@@ -0,0 +1,100 @@
+/*
+ * Copyright 2018 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.xml.xsd;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+/**
+ * @author Greg Turnquist
+ * @see 3.0.5
+ */
+public class DocumentBuilderFactoryUtils {
+
+	private static final Log log = LogFactory.getLog(DocumentBuilderFactoryUtils.class);
+
+	/**
+	 * Build a {@link DocumentBuilderFactory} then set properties to prevent external entity access.
+	 *
+	 * @see DocumentBuilderFactory#newInstance()
+	 */
+	public static DocumentBuilderFactory newInstance() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+
+		try {
+			factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+		} catch (IllegalArgumentException e) {
+			if (log.isWarnEnabled()) {
+				log.warn(XMLConstants.ACCESS_EXTERNAL_DTD + " property not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+		} catch (IllegalArgumentException e) {
+			if (log.isWarnEnabled()) {
+				log.warn(XMLConstants.ACCESS_EXTERNAL_SCHEMA + " property not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+		} catch (ParserConfigurationException e) {
+			if (log.isWarnEnabled()) {
+				log.warn("FEATURE 'http://apache.org/xml/features/disallow-doctype-decl' is probably not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+		} catch (ParserConfigurationException e) {
+			if (log.isWarnEnabled()) {
+				log.warn("FEATURE 'http://xml.org/sax/features/external-general-entities' is probably not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+		} catch (ParserConfigurationException e) {
+			if (log.isWarnEnabled()) {
+				log.warn("FEATURE 'http://xml.org/sax/features/external-parameter-entities' is probably not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+		} catch (ParserConfigurationException e) {
+			if (log.isWarnEnabled()) {
+				log.warn("FEATURE 'http://apache.org/xml/features/nonvalidating/load-external-dtd' is probably not supported by " + factory.getClass().getCanonicalName());
+			}
+		}
+
+		try {
+			factory.setXIncludeAware(false);
+			factory.setExpandEntityReferences(false);
+		} catch (Exception e) {
+			if (log.isWarnEnabled()) {
+				log.warn("Caught " + e.getMessage() + " attempting to configure your XML parser.");
+			}
+		}
+
+		return factory;
+	}
+}

spring-xml/src/main/java/org/springframework/xml/xsd/SimpleXsdSchema.java

@@ -31,6 +31,7 @@ import org.xml.sax.SAXException;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.core.io.Resource;
 import org.springframework.util.Assert;
+import org.springframework.xml.DocumentBuilderFactoryUtils;
 import org.springframework.xml.sax.SaxUtils;
 import org.springframework.xml.validation.XmlValidator;
 import org.springframework.xml.validation.XmlValidatorFactory;
@@ -47,7 +48,7 @@ import org.springframework.xml.validation.XmlValidatorFactory;
  */
 public class SimpleXsdSchema implements XsdSchema, InitializingBean {
 
-	private static DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+	private static DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 
 	private static final String SCHEMA_NAMESPACE = "http://www.w3.org/2001/XMLSchema";
 

spring-xml/src/test/java/org/springframework/xml/dom/DomContentHandlerTest.java

@@ -28,6 +28,8 @@ import org.xml.sax.InputSource;
 import org.xml.sax.XMLReader;
 import org.xml.sax.helpers.XMLReaderFactory;
 
+import org.springframework.xml.DocumentBuilderFactoryUtils;
+
 import static org.custommonkey.xmlunit.XMLAssert.assertXMLEqual;
 
 public class DomContentHandlerTest {
@@ -55,7 +57,7 @@ public class DomContentHandlerTest {
 
 	@Before
 	public void setUp() throws Exception {
-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 		documentBuilderFactory.setNamespaceAware(true);
 		documentBuilder = documentBuilderFactory.newDocumentBuilder();
 		result = documentBuilder.newDocument();

spring-xml/src/test/java/org/springframework/xml/namespace/QNameUtilsTest.java

@@ -20,13 +20,14 @@ import javax.xml.namespace.QName;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 
-import org.springframework.util.StringUtils;
-
 import org.junit.Assert;
 import org.junit.Test;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
+import org.springframework.util.StringUtils;
+import org.springframework.xml.DocumentBuilderFactoryUtils;
+
 public class QNameUtilsTest {
 
 	@Test
@@ -45,7 +46,7 @@ public class QNameUtilsTest {
 
 	@Test
 	public void testGetQNameForNodeNoNamespace() throws Exception {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory factory = DocumentBuilderFactoryUtils.newInstance();
 		DocumentBuilder builder = factory.newDocumentBuilder();
 		Document document = builder.newDocument();
 		Element element = document.createElement("localname");
@@ -59,7 +60,7 @@ public class QNameUtilsTest {
 
 	@Test
 	public void testGetQNameForNodeNoPrefix() throws Exception {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory factory = DocumentBuilderFactoryUtils.newInstance();
 		DocumentBuilder builder = factory.newDocumentBuilder();
 		Document document = builder.newDocument();
 		Element element = document.createElementNS("namespace", "localname");
@@ -72,7 +73,7 @@ public class QNameUtilsTest {
 
 	@Test
 	public void testGetQNameForNode() throws Exception {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory factory = DocumentBuilderFactoryUtils.newInstance();
 		DocumentBuilder builder = factory.newDocumentBuilder();
 		Document document = builder.newDocument();
 		Element element = document.createElementNS("namespace", "prefix:localname");

spring-xml/src/test/java/org/springframework/xml/transform/ResourceSourceTest.java

@@ -17,20 +17,19 @@
 package org.springframework.xml.transform;
 
 import javax.xml.transform.Transformer;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMResult;
 
-import org.springframework.core.io.ClassPathResource;
-
 import org.junit.Assert;
 import org.junit.Test;
 import org.w3c.dom.Element;
 
+import org.springframework.core.io.ClassPathResource;
+
 public class ResourceSourceTest {
 
 	@Test
 	public void testStringSource() throws Exception {
-		Transformer transformer = TransformerFactory.newInstance().newTransformer();
+		Transformer transformer = TransformerFactoryUtils.newInstance().newTransformer();
 		DOMResult result = new DOMResult();
 		ResourceSource source = new ResourceSource(new ClassPathResource("resourceSource.xml", getClass()));
 		transformer.transform(source, result);

spring-xml/src/test/java/org/springframework/xml/transform/StringResultTest.java

@@ -16,25 +16,25 @@
 
 package org.springframework.xml.transform;
 
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.transform.Transformer;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 
 import org.junit.Test;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
-import static org.custommonkey.xmlunit.XMLAssert.assertXMLEqual;
+import org.springframework.xml.DocumentBuilderFactoryUtils;
+
+import static org.custommonkey.xmlunit.XMLAssert.*;
 
 public class StringResultTest {
 
 	@Test
 	public void testStringResult() throws Exception {
-		Document document = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument();
+		Document document = DocumentBuilderFactoryUtils.newInstance().newDocumentBuilder().newDocument();
 		Element element = document.createElementNS("namespace", "prefix:localName");
 		document.appendChild(element);
-		Transformer transformer = TransformerFactory.newInstance().newTransformer();
+		Transformer transformer = TransformerFactoryUtils.newInstance().newTransformer();
 		StringResult result = new StringResult();
 		transformer.transform(new DOMSource(document), result);
 		assertXMLEqual("Invalid result", "<prefix:localName xmlns:prefix='namespace'/>", result.toString());

spring-xml/src/test/java/org/springframework/xml/transform/StringSourceTest.java

@@ -29,7 +29,7 @@ public class StringSourceTest {
 
 	@Test
 	public void testStringSource() throws TransformerException {
-		Transformer transformer = TransformerFactory.newInstance().newTransformer();
+		Transformer transformer = TransformerFactoryUtils.newInstance().newTransformer();
 		String content = "<prefix:content xmlns:prefix='namespace'/>";
 		DOMResult result = new DOMResult();
 		transformer.transform(new StringSource(content), result);

spring-xml/src/test/java/org/springframework/xml/transform/TraxUtilsTest.java

@@ -41,8 +41,6 @@ import javax.xml.transform.sax.SAXSource;
 import javax.xml.transform.stream.StreamResult;
 import javax.xml.transform.stream.StreamSource;
 
-import org.springframework.util.xml.StaxUtils;
-
 import org.junit.Assert;
 import org.junit.Test;
 import org.w3c.dom.Document;
@@ -55,13 +53,17 @@ import org.xml.sax.ext.LexicalHandler;
 import org.xml.sax.helpers.DefaultHandler;
 import org.xml.sax.helpers.XMLReaderFactory;
 
+import org.springframework.util.xml.StaxUtils;
+import org.springframework.xml.XMLInputFactoryUtils;
+import org.springframework.xml.DocumentBuilderFactoryUtils;
+
 import static org.easymock.EasyMock.*;
 
 public class TraxUtilsTest {
 
 	@Test
 	public void testGetDocument() throws Exception {
-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 		documentBuilderFactory.setNamespaceAware(true);
 		DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
 		Document document = documentBuilder.newDocument();
@@ -73,7 +75,7 @@ public class TraxUtilsTest {
 
 	@Test
 	public void testDoWithDomSource() throws Exception {
-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 		DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
 		Document document = documentBuilder.newDocument();
 
@@ -89,7 +91,7 @@ public class TraxUtilsTest {
 
 	@Test
 	public void testDoWithDomResult() throws Exception {
-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 		DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
 		Document document = documentBuilder.newDocument();
 
@@ -137,7 +139,7 @@ public class TraxUtilsTest {
 
 	@Test
 	public void testDoWithStaxSourceEventReader() throws Exception {
-		XMLInputFactory inputFactory = XMLInputFactory.newInstance();
+		XMLInputFactory inputFactory = XMLInputFactoryUtils.newInstance();
 		XMLEventReader eventReader = inputFactory.createXMLEventReader(new StringReader("<element/>"));
 
 		TraxUtils.SourceCallback mock = createMock(TraxUtils.SourceCallback.class);
@@ -167,7 +169,7 @@ public class TraxUtilsTest {
 
 	@Test
 	public void testDoWithStaxSourceStreamReader() throws Exception {
-		XMLInputFactory inputFactory = XMLInputFactory.newInstance();
+		XMLInputFactory inputFactory = XMLInputFactoryUtils.newInstance();
 		XMLStreamReader streamReader = inputFactory.createXMLStreamReader(new StringReader("<element/>"));
 
 		TraxUtils.SourceCallback mock = createMock(TraxUtils.SourceCallback.class);

spring-xml/src/test/java/org/springframework/xml/validation/AbstractValidatorFactoryTestCase.java

@@ -23,10 +23,6 @@ import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.sax.SAXSource;
 import javax.xml.transform.stream.StreamSource;
 
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.core.io.Resource;
-import org.springframework.xml.transform.ResourceSource;
-
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -36,6 +32,11 @@ import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
 import org.xml.sax.SAXParseException;
 
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.xml.transform.ResourceSource;
+import org.springframework.xml.DocumentBuilderFactoryUtils;
+
 public abstract class AbstractValidatorFactoryTestCase {
 
 	private XmlValidator validator;
@@ -98,7 +99,7 @@ public abstract class AbstractValidatorFactoryTestCase {
 
 	@Test
 	public void testHandleValidMessageDom() throws Exception {
-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 		documentBuilderFactory.setNamespaceAware(true);
 		Document document = documentBuilderFactory.newDocumentBuilder()
 				.parse(new InputSource(validInputStream));
@@ -109,7 +110,7 @@ public abstract class AbstractValidatorFactoryTestCase {
 
 	@Test
 	public void testHandleInvalidMessageDom() throws Exception {
-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 		documentBuilderFactory.setNamespaceAware(true);
 		Document document = documentBuilderFactory.newDocumentBuilder()
 				.parse(new InputSource(invalidInputStream));

spring-xml/src/test/java/org/springframework/xml/validation/Jaxp15ValidatorFactoryTest.java

@@ -0,0 +1,29 @@
+/*
+ * Copyright 2005-2010 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.xml.validation;
+
+import java.io.IOException;
+
+import org.springframework.core.io.Resource;
+
+public class Jaxp15ValidatorFactoryTest extends AbstractValidatorFactoryTestCase {
+
+	@Override
+	protected XmlValidator createValidator(Resource[] schemaResources, String schemaLanguage) throws IOException {
+		return Jaxp15ValidatorFactory.createValidator(schemaResources, schemaLanguage);
+	}
+}

spring-xml/src/test/java/org/springframework/xml/xpath/AbstractXPathExpressionFactoryTestCase.java

@@ -33,6 +33,7 @@ import org.w3c.dom.Node;
 import org.xml.sax.SAXException;
 
 import org.springframework.util.StringUtils;
+import org.springframework.xml.DocumentBuilderFactoryUtils;
 
 public abstract class AbstractXPathExpressionFactoryTestCase {
 
@@ -46,7 +47,7 @@ public abstract class AbstractXPathExpressionFactoryTestCase {
 	public void setUp() throws Exception {
 		namespaces.put("prefix1", "namespace1");
 		namespaces.put("prefix2", "namespace2");
-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 		documentBuilderFactory.setNamespaceAware(true);
 		DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
 		InputStream inputStream = getClass().getResourceAsStream("nonamespaces.xml");

spring-xml/src/test/java/org/springframework/xml/xpath/AbstractXPathTemplateTestCase.java

@@ -34,6 +34,7 @@ import javax.xml.transform.stream.StreamSource;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.xml.sax.SaxUtils;
 import org.springframework.xml.transform.ResourceSource;
+import org.springframework.xml.DocumentBuilderFactoryUtils;
 
 import org.junit.Assert;
 import org.junit.Before;
@@ -128,7 +129,7 @@ public abstract class AbstractXPathTemplateTestCase {
 
 	@Test
 	public void testEvaluateDomSource() throws IOException, SAXException, ParserConfigurationException {
-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 		documentBuilderFactory.setNamespaceAware(true);
 		DocumentBuilder documentBuilder = documentBuilderFactory.newDocumentBuilder();
 		Document document = documentBuilder.parse(SaxUtils.createInputSource(

spring-xml/src/test/java/org/springframework/xml/xsd/AbstractXsdSchemaTestCase.java

@@ -22,18 +22,20 @@ import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMResult;
 
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.core.io.Resource;
-import org.springframework.xml.sax.SaxUtils;
-import org.springframework.xml.validation.XmlValidator;
-
 import org.custommonkey.xmlunit.XMLUnit;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.w3c.dom.Document;
 
-import static org.custommonkey.xmlunit.XMLAssert.assertXMLEqual;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.xml.DocumentBuilderFactoryUtils;
+import org.springframework.xml.sax.SaxUtils;
+import org.springframework.xml.transform.TransformerFactoryUtils;
+import org.springframework.xml.validation.XmlValidator;
+
+import static org.custommonkey.xmlunit.XMLAssert.*;
 
 public abstract class AbstractXsdSchemaTestCase {
 
@@ -43,10 +45,10 @@ public abstract class AbstractXsdSchemaTestCase {
 
 	@Before
 	public final void setUp() throws Exception {
-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 		documentBuilderFactory.setNamespaceAware(true);
 		documentBuilder = documentBuilderFactory.newDocumentBuilder();
-		TransformerFactory transformerFactory = TransformerFactory.newInstance();
+		TransformerFactory transformerFactory = TransformerFactoryUtils.newInstance();
 		transformer = transformerFactory.newTransformer();
 		XMLUnit.setIgnoreWhitespace(true);
 	}

spring-xml/src/test/java/org/springframework/xml/xsd/commons/CommonsXsdSchemaCollectionTest.java

@@ -22,20 +22,22 @@ import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMResult;
 
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.core.io.Resource;
-import org.springframework.xml.sax.SaxUtils;
-import org.springframework.xml.validation.XmlValidator;
-import org.springframework.xml.xsd.AbstractXsdSchemaTestCase;
-import org.springframework.xml.xsd.XsdSchema;
-
 import org.custommonkey.xmlunit.XMLUnit;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.w3c.dom.Document;
 
-import static org.custommonkey.xmlunit.XMLAssert.assertXMLEqual;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.core.io.Resource;
+import org.springframework.xml.sax.SaxUtils;
+import org.springframework.xml.transform.TransformerFactoryUtils;
+import org.springframework.xml.validation.XmlValidator;
+import org.springframework.xml.xsd.AbstractXsdSchemaTestCase;
+import org.springframework.xml.DocumentBuilderFactoryUtils;
+import org.springframework.xml.xsd.XsdSchema;
+
+import static org.custommonkey.xmlunit.XMLAssert.*;
 
 public class CommonsXsdSchemaCollectionTest {
 
@@ -48,9 +50,9 @@ public class CommonsXsdSchemaCollectionTest {
 	@Before
 	public void setUp() throws Exception {
 		collection = new CommonsXsdSchemaCollection();
-		TransformerFactory transformerFactory = TransformerFactory.newInstance();
+		TransformerFactory transformerFactory = TransformerFactoryUtils.newInstance();
 		transformer = transformerFactory.newTransformer();
-		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactoryUtils.newInstance();
 		documentBuilderFactory.setNamespaceAware(true);
 		documentBuilder = documentBuilderFactory.newDocumentBuilder();
 		XMLUnit.setIgnoreWhitespace(true);