LPS-50479 Refactor DocumentBuilderFactory.newInstance() into SecureXMLBuilderUtil.newDocumentBuilderFactory()
LPS-50479 Refactor XMLInputFactory.newInstance() into SecureXMLBuilderUtil.newXMLInputFactory(), please note that XMLInputFactory.newFactory() Javadoc states that XMLInputFactory.newInstance() is deprecated
LPS-50479 Refactor "new SAXParser()" into SecureXMLBuilder.newXMLReader()
LPS-50479 Secure JAXB + JAXP initialization, from now all DTD based XMLs cannot be validated
LPS-50479 Apply to XSL Content portlet
LPS-50479 Update Source Formatter
LPS-50479 JUnit tests
LPS-50479 Update xml.xsd to the newest version to allow XSD validation with disabled DTD
LPS-50479 Introduce insecure methods for trusted sources allowing DTD validation
LPS-50479 Introduce trusted sources into SAXReaderImpl
LPS-50479 Implement insecure parsing for trusted sources
LPS-50479 Trust all xmls = reopen the XML vulnerabilities for now, we need to be able to start portal and do some peer reviews. For untrusted inputs we need to (1) revert it back to use SAXReaderUtil#read method and (2) create XSD for places where we currently validate using DTD, we cannot support DTD validation for untrusted inputs.