@wendal
hi! 大神好
请问nutz里面，Xmls类里面，直接new DocumentBuilderFactory(), 是否存在XML外部实体注入漏洞？
相关代码贴在下面了。
public static DocumentBuilder xmls() throws ParserConfigurationException {
return DocumentBuilderFactory.newInstance().newDocumentBuilder();
}
public abstract class DocumentBuilderFactory {
private boolean validating = false;
private boolean namespaceAware = false;
private boolean whitespace = false;
private boolean expandEntityRef = true;//这里是否有XML外部实体注入漏洞？
private boolean ignoreComments = false;
private boolean coalescing = false;
/**
* <p>Protected constructor to prevent instantiation.
* Use {@link #newInstance()}.</p>
*/
protected DocumentBuilderFactory () {
}