Configure DocumentBuilderFactory to disallow doctype declaration etc.
New method getNewDocumentBuilder()
Use XmlUtils.getNewDocumentBuilder() method