eclipse/eclipse-CVE-2023-4218.patch

--- a/eclipse.jdt.core/org.eclipse.jdt.apt.core/src/org/eclipse/jdt/apt/core/internal/util/FactoryPathUtil.java	2024-03-19 10:01:54.583093542 +0100
+++ b/eclipse.jdt.core/org.eclipse.jdt.apt.core/src/org/eclipse/jdt/apt/core/internal/util/FactoryPathUtil.java	2024-03-19 13:58:56.303373550 +0100
@@ -25,6 +25,7 @@
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
+import org.eclipse.core.internal.runtime.XmlProcessorFactory;
 import org.eclipse.core.resources.IFile;
 import org.eclipse.core.resources.IProject;
 import org.eclipse.core.resources.IResource;
@@ -221,8 +222,9 @@
 		Element fpElement = null;
 
 		try {
-			DocumentBuilder parser = 
-				DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			@SuppressWarnings("restriction")
+			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory
+					.createDocumentBuilderWithErrorOnDOCTYPE();
 			fpElement = parser.parse(new InputSource(reader)).getDocumentElement();
 
 		}
--- a/eclipse.jdt.core/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLComparer.java	2024-03-19 10:01:54.613093606 +0100
+++ b/eclipse.jdt.core/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLComparer.java	2024-03-19 13:58:56.306706890 +0100
@@ -164,8 +164,7 @@
 			"</model>\n";
 		
 		// create "actual" model
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-		Document actualModel = factory.newDocumentBuilder().newDocument();
+		Document actualModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 		Element modelNode = actualModel.createElement(MODEL_TAG);
 		// primary type
 		Element typeNode = actualModel.createElement(TYPE_ELEMENT_TAG);
@@ -203,7 +202,7 @@
 		
 		// load reference model
     	InputSource source = new InputSource(new StringReader(XML_FRAMEWORK_TEST_MODEL));
-        Document expectedModel = factory.newDocumentBuilder().parse(source);
+        Document expectedModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().parse(source);
 
         // compare actual and reference
         ByteArrayOutputStream out = new ByteArrayOutputStream();
--- a/eclipse.jdt.core/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLConverter.java	2024-03-19 10:01:54.613093606 +0100
+++ b/eclipse.jdt.core/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/base/XMLConverter.java	2024-03-19 13:58:56.306706890 +0100
@@ -65,7 +65,7 @@
 		StringWriter s = new StringWriter();
 		DOMSource domSource = new DOMSource(model);
 		StreamResult streamResult = new StreamResult(s);
-		TransformerFactory tf = TransformerFactory.newInstance();
+		TransformerFactory tf = org.eclipse.core.internal.runtime.XmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
 		Transformer serializer;
 		try {
 			serializer = tf.newTransformer();
@@ -146,8 +146,7 @@
 	 * @throws ParserConfigurationException
 	 */
 	public static Document convertModel(Iterable<? extends javax.lang.model.element.Element> declarations) throws ParserConfigurationException {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-		Document model = factory.newDocumentBuilder().newDocument();
+		Document model = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 		org.w3c.dom.Element modelNode = model.createElement(MODEL_TAG);
 		
 		XMLConverter converter = new XMLConverter(model);
--- a/eclipse.jdt.core/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/negative/NegativeModelProc.java	2024-03-19 10:01:54.613093606 +0100
+++ b/eclipse.jdt.core/org.eclipse.jdt.compiler.apt.tests/processors/org/eclipse/jdt/compiler/apt/tests/processors/negative/NegativeModelProc.java	2024-03-19 13:58:56.306706890 +0100
@@ -41,7 +41,6 @@
 import javax.lang.model.type.TypeKind;
 import javax.lang.model.type.TypeMirror;
 import javax.lang.model.util.Elements;
-import javax.xml.parsers.DocumentBuilderFactory;
 
 import org.eclipse.jdt.compiler.apt.tests.processors.base.XMLComparer;
 import org.eclipse.jdt.compiler.apt.tests.processors.base.XMLConverter;
@@ -844,8 +843,7 @@
 		Document actualModel = XMLConverter.convertModel(rootElements);
 		
     	InputSource source = new InputSource(new StringReader(expected));
-    	DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-        Document expectedModel = factory.newDocumentBuilder().parse(source);
+        Document expectedModel = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().parse(source);
 
         ByteArrayOutputStream out = new ByteArrayOutputStream();
         StringBuilder summary = new StringBuilder();
--- a/eclipse.jdt.core/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaModelManager.java	2024-03-19 10:01:54.859760804 +0100
+++ b/eclipse.jdt.core/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaModelManager.java	2024-03-19 13:58:56.306706890 +0100
@@ -54,7 +54,6 @@
 import java.util.zip.ZipFile;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.eclipse.core.resources.IFile;
@@ -3612,7 +3611,8 @@
 				StringReader reader = new StringReader(xmlString);
 				Element cpElement;
 				try {
-					DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+					@SuppressWarnings("restriction")
+					DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 					cpElement = parser.parse(new InputSource(reader)).getDocumentElement();
 				} catch(SAXException | ParserConfigurationException e){
 					return;
--- a/eclipse.jdt.core/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaProject.java	2024-03-19 10:01:54.859760804 +0100
+++ b/eclipse.jdt.core/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/JavaProject.java	2024-03-19 13:58:56.306706890 +0100
@@ -38,7 +38,6 @@
 import java.util.stream.Collectors;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import org.eclipse.core.resources.ICommand;
 import org.eclipse.core.resources.IFile;
@@ -1268,7 +1267,8 @@
 		StringReader reader = new StringReader(xmlClasspath);
 		Element cpElement;
 		try {
-			DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			@SuppressWarnings("restriction")
+			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			cpElement = parser.parse(new InputSource(reader)).getDocumentElement();
 		} catch (SAXException | ParserConfigurationException e) {
 			throw new IOException(Messages.file_badFormat, e);
@@ -1329,8 +1329,9 @@
 			Element node;
 
 			try {
+				@SuppressWarnings("restriction")
 				DocumentBuilder parser =
-					DocumentBuilderFactory.newInstance().newDocumentBuilder();
+						org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 				node = parser.parse(new InputSource(reader)).getDocumentElement();
 			} catch (SAXException | ParserConfigurationException e) {
 				return null;
--- a/eclipse.jdt.core/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/UserLibrary.java	2024-03-19 10:01:54.859760804 +0100
+++ b/eclipse.jdt.core/org.eclipse.jdt.core/model/org/eclipse/jdt/internal/core/UserLibrary.java	2024-03-19 13:58:56.310040231 +0100
@@ -21,7 +21,6 @@
 import java.util.ArrayList;
 import java.util.HashMap;
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.eclipse.core.runtime.Assert;
@@ -150,7 +149,8 @@
 	public static UserLibrary createFromString(Reader reader) throws IOException {
 		Element cpElement;
 		try {
-			DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			@SuppressWarnings("restriction")
+			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			cpElement = parser.parse(new InputSource(reader)).getDocumentElement();
 		} catch (SAXException | ParserConfigurationException e) {
 			throw new IOException(Messages.file_badFormat, e);
--- a/eclipse.jdt.core/org.eclipse.jdt.core.internal.tools/src/org/eclipse/jdt/core/internal/tools/unicode/TableBuilder.java	2024-03-19 10:01:54.613093606 +0100
+++ b/eclipse.jdt.core/org.eclipse.jdt.core.internal.tools/src/org/eclipse/jdt/core/internal/tools/unicode/TableBuilder.java	2024-03-19 13:58:56.306706890 +0100
@@ -42,11 +42,10 @@
 		List<String> result = new ArrayList<>();
 		SAXParser saxParser = null;
 		try {
-			saxParser = SAXParserFactory.newInstance().newSAXParser();
-		} catch (ParserConfigurationException e) {
-			e.printStackTrace();
-			return null;
-		} catch (SAXException e) {
+			@SuppressWarnings("restriction")
+			SAXParser p = org.eclipse.core.internal.runtime.XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
+			saxParser =p;
+		} catch (SAXException | ParserConfigurationException e) {
 			e.printStackTrace();
 			return null;
 		}
--- a/eclipse.jdt.core/org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/formatter/DecodeCodeFormatterPreferences.java	2024-03-19 10:01:54.633093649 +0100
+++ b/eclipse.jdt.core/org.eclipse.jdt.core.tests.model/src/org/eclipse/jdt/core/tests/formatter/DecodeCodeFormatterPreferences.java	2024-03-19 13:58:56.306706890 +0100
@@ -26,8 +26,8 @@
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
+import org.eclipse.core.internal.runtime.XmlProcessorFactory;
 import org.xml.sax.Attributes;
 import org.xml.sax.SAXException;
 import org.xml.sax.helpers.DefaultHandler;
@@ -63,7 +63,7 @@
 
 	public static Map decodeCodeFormatterOptions(String fileName, String profileName) {
 		try {
-			SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
+			SAXParser saxParser = XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 			final DecodeCodeFormatterPreferences preferences = new DecodeCodeFormatterPreferences(profileName);
 			saxParser.parse(new File(fileName), preferences);
 			return preferences.getEntries();
@@ -89,7 +89,7 @@
 				return null;
 			}
 			inputStream = new BufferedInputStream(zipFile.getInputStream(zipEntry));
-			SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
+			SAXParser saxParser = XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 			final DecodeCodeFormatterPreferences preferences = new DecodeCodeFormatterPreferences(profileName);
 			saxParser.parse(inputStream, preferences);
 			return preferences.getEntries();
--- a/eclipse.jdt.ui/org.eclipse.jdt.junit.core/src/org/eclipse/jdt/internal/junit/model/JUnitModel.java	2024-03-19 10:01:55.446428735 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.junit.core/src/org/eclipse/jdt/internal/junit/model/JUnitModel.java	2024-03-19 14:27:33.606659565 +0100
@@ -33,7 +33,6 @@
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerConfigurationException;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.TransformerFactoryConfigurationError;
 import javax.xml.transform.sax.SAXSource;
 import javax.xml.transform.stream.StreamResult;
@@ -65,6 +64,7 @@
 import org.eclipse.jdt.internal.junit.Messages;
 import org.eclipse.jdt.internal.junit.launcher.JUnitLaunchConfigurationConstants;
 import org.eclipse.jdt.internal.junit.model.TestElement.Status;
+import org.eclipse.jdt.internal.junit.util.XmlProcessorFactoryJdtJunit;
 import org.eclipse.jdt.junit.ITestRunListener;
 
 /**
@@ -386,7 +386,7 @@
 	 */
 	public static TestRunSession importTestRunSession(File file) throws CoreException {
 		try {
-			SAXParserFactory parserFactory= SAXParserFactory.newInstance();
+			SAXParserFactory parserFactory= XmlProcessorFactoryJdtJunit.createSAXFactoryWithErrorOnDOCTYPE();
 //			parserFactory.setValidating(true); // TODO: add DTD and debug flag
 			SAXParser parser= parserFactory.newSAXParser();
 			TestRunHandler handler= new TestRunHandler();
@@ -429,7 +429,7 @@
 			@Override
 			public void run() {
 				try {
-					SAXParserFactory parserFactory= SAXParserFactory.newInstance();
+					SAXParserFactory parserFactory= XmlProcessorFactoryJdtJunit.createSAXFactoryWithErrorOnDOCTYPE();
 //					parserFactory.setValidating(true); // TODO: add DTD and debug flag
 					SAXParser parser= parserFactory.newSAXParser();
 					parser.parse(trimmedUrl, handler);
@@ -477,7 +477,7 @@
 
 	public static void importIntoTestRunSession(File swapFile, TestRunSession testRunSession) throws CoreException {
 		try {
-			SAXParserFactory parserFactory= SAXParserFactory.newInstance();
+			SAXParserFactory parserFactory= XmlProcessorFactoryJdtJunit.createSAXFactoryWithErrorOnDOCTYPE();
 //			parserFactory.setValidating(true); // TODO: add DTD and debug flag
 			SAXParser parser= parserFactory.newSAXParser();
 			TestRunHandler handler= new TestRunHandler(testRunSession);
@@ -527,7 +527,7 @@
 	public static void exportTestRunSession(TestRunSession testRunSession, OutputStream out)
 			throws TransformerFactoryConfigurationError, TransformerException {
 
-		Transformer transformer= TransformerFactory.newInstance().newTransformer();
+		Transformer transformer= XmlProcessorFactoryJdtJunit.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 		InputSource inputSource= new InputSource();
 		SAXSource source= new SAXSource(new TestRunSessionSerializer(testRunSession), inputSource);
 		StreamResult result= new StreamResult(out);
--- a/eclipse.jdt.ui/org.eclipse.jdt.junit.core/src/org/eclipse/jdt/internal/junit/util/XmlProcessorFactoryJdtJunit.java	1970-01-01 01:00:00.000000000 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.junit.core/src/org/eclipse/jdt/internal/junit/util/XmlProcessorFactoryJdtJunit.java	2024-03-19 14:26:46.589900854 +0100
@@ -0,0 +1,166 @@
+/*******************************************************************************
+ *  Copyright (c) 2023 Joerg Kubitz and others.
+ *
+ *  This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License 2.0
+ *  which accompanies this distribution, and is available at
+ *  https://www.eclipse.org/legal/epl-2.0/
+ *
+ *  SPDX-License-Identifier: EPL-2.0
+ *******************************************************************************/
+package org.eclipse.jdt.internal.junit.util;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.TransformerFactory;
+
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+
+/**
+ * XML processing which prohibits external entities.
+ *
+ * @see <a href="https://rules.sonarsource.com/java/RSPEC-2755/">RSPEC-2755</a>
+ */
+public class XmlProcessorFactoryJdtJunit {
+	private XmlProcessorFactoryJdtJunit() {
+		// static Utility only
+	}
+
+	private static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE = createDocumentBuilderFactoryWithErrorOnDOCTYPE();
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE = createSAXFactoryWithErrorOnDOCTYPE(false);
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE_NS = createSAXFactoryWithErrorOnDOCTYPE(true);
+	private static final SAXParserFactory SAX_FACTORY_IGNORING_DOCTYPE = createSAXFactoryIgnoringDOCTYPE();
+
+	/**
+	 * Creates TransformerFactory which throws TransformerException when
+	 * detecting external entities.
+	 *
+	 * @return javax.xml.transform.TransformerFactory
+	 */
+	public static TransformerFactory createTransformerFactoryWithErrorOnDOCTYPE() {
+		TransformerFactory factory = TransformerFactory.newInstance();
+		// prohibit the use of all protocols by external entities:
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); //$NON-NLS-1$
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when
+	 * detecting external entities. It's magnitudes faster to call
+	 * {@link #createDocumentBuilderWithErrorOnDOCTYPE()}.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static synchronized DocumentBuilderFactory createDocumentBuilderFactoryWithErrorOnDOCTYPE() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		// completely disable DOCTYPE declaration:
+		try {
+			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (ParserConfigurationException e) {
+			throw new RuntimeException(e.getMessage(), e);
+		}
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilder which throws SAXParseException when detecting
+	 * external entities. The builder is not thread safe.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilder
+	 * @throws ParserConfigurationException
+	 */
+	public static DocumentBuilder createDocumentBuilderWithErrorOnDOCTYPE() throws ParserConfigurationException {
+		return DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE.newDocumentBuilder();
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when
+	 * detecting external entities.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE() {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		try {
+			// force org.xml.sax.SAXParseException for any DOCTYPE:
+			f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	private static synchronized SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE(boolean awareness) {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		f.setNamespaceAware(awareness);
+		try {
+			// force org.xml.sax.SAXParseException for any DOCTYPE:
+			f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	private static synchronized SAXParserFactory createSAXFactoryIgnoringDOCTYPE() {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		try {
+			// ignore DOCTYPE:
+			f.setFeature("http://xml.org/sax/features/external-general-entities", false); //$NON-NLS-1$
+			f.setFeature("http://xml.org/sax/features/external-parameter-entities", false); //$NON-NLS-1$
+			f.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	/**
+	 * Creates SAXParser which throws SAXParseException when detecting external
+	 * entities.
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+
+	public static SAXParser createSAXParserWithErrorOnDOCTYPE() throws ParserConfigurationException, SAXException {
+		return createSAXParserWithErrorOnDOCTYPE(false);
+	}
+
+	/**
+	 * Creates SAXParser which throws SAXParseException when detecting external
+	 * entities.
+	 *
+	 * @param namespaceAware
+	 *            parameter for SAXParserFactory
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+	public static SAXParser createSAXParserWithErrorOnDOCTYPE(boolean namespaceAware)
+			throws ParserConfigurationException, SAXException {
+		if (namespaceAware) {
+			return SAX_FACTORY_ERROR_ON_DOCTYPE_NS.newSAXParser();
+		}
+		return SAX_FACTORY_ERROR_ON_DOCTYPE.newSAXParser();
+	}
+
+	/**
+	 * Creates SAXParser which does not throw Exception when detecting external
+	 * entities but ignores them.
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+	public static SAXParser createSAXParserIgnoringDOCTYPE()
+			throws ParserConfigurationException, SAXNotRecognizedException, SAXNotSupportedException, SAXException {
+		SAXParser parser = SAX_FACTORY_IGNORING_DOCTYPE.newSAXParser();
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); //$NON-NLS-1$
+		return parser;
+	}
+}
\ No newline at end of file
--- "a/eclipse.jdt.ui/org.eclipse.jdt.ui/core extension/org/eclipse/jdt/internal/corext/template/java/TemplateSet.java"	2024-03-19 10:01:55.476428800 +0100
+++ "b/eclipse.jdt.ui/org.eclipse.jdt.ui/core extension/org/eclipse/jdt/internal/corext/template/java/TemplateSet.java"	2024-03-19 14:26:46.589900854 +0100
@@ -29,7 +29,6 @@
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
@@ -53,6 +52,8 @@
 import org.eclipse.jface.text.templates.TemplateContextType;
 import org.eclipse.jface.text.templates.TemplateException;
 
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
+
 /**
  * <code>TemplateSet</code> manages a collection of templates and makes them
  * persistent.
@@ -121,7 +122,7 @@
 	 */
 	public void addFromStream(InputStream stream, boolean allowDuplicates) throws CoreException {
 		try {
-			DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+			DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 			DocumentBuilder parser= factory.newDocumentBuilder();
 			parser.setErrorHandler(new DefaultHandler());
 			Document document= parser.parse(new InputSource(stream));
@@ -230,7 +231,7 @@
 	 */
 	public void saveToStream(OutputStream stream) throws CoreException {
 		try {
-			DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+			DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 			DocumentBuilder builder= factory.newDocumentBuilder();
 			Document document= builder.newDocument();
 
@@ -262,7 +263,7 @@
 			}
 
 
-			Transformer transformer=TransformerFactory.newInstance().newTransformer();
+			Transformer transformer= XmlProcessorFactoryJdtUi.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 			transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 			transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8"); //$NON-NLS-1$
 			DOMSource source = new DOMSource(document);
--- "a/eclipse.jdt.ui/org.eclipse.jdt.ui/core extension/org/eclipse/jdt/internal/corext/util/History.java"	2024-03-19 10:01:55.476428800 +0100
+++ "b/eclipse.jdt.ui/org.eclipse.jdt.ui/core extension/org/eclipse/jdt/internal/corext/util/History.java"	2024-03-19 14:28:39.276788126 +0100
@@ -32,7 +32,6 @@
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.TransformerFactoryConfigurationError;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
@@ -55,6 +54,7 @@
 import org.eclipse.jdt.internal.ui.JavaPlugin;
 import org.eclipse.jdt.internal.ui.JavaUIException;
 import org.eclipse.jdt.internal.ui.JavaUIStatus;
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
 import org.eclipse.jdt.internal.core.manipulation.util.BasicElementLabels;
 
 /**
@@ -257,7 +257,7 @@
 	private void load(InputSource inputSource) throws CoreException {
 		Element root;
 		try {
-			DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			DocumentBuilder parser = XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE().newDocumentBuilder();
 			parser.setErrorHandler(new DefaultHandler());
 			root = parser.parse(inputSource).getDocumentElement();
 		} catch (SAXException e) {
@@ -291,7 +291,7 @@
 
 	private void save(OutputStream stream) throws CoreException {
 		try {
-			DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+			DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 			DocumentBuilder builder= factory.newDocumentBuilder();
 			Document document= builder.newDocument();
 
@@ -306,7 +306,7 @@
 				rootElement.appendChild(element);
 			}
 
-			Transformer transformer=TransformerFactory.newInstance().newTransformer();
+			Transformer transformer= XmlProcessorFactoryJdtUi.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 			transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 			transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8"); //$NON-NLS-1$
 			transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/jarpackager/JarPackageReader.java	2024-03-19 10:01:55.509762205 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/jarpackager/JarPackageReader.java	2024-03-19 14:26:46.593234194 +0100
@@ -69,6 +69,7 @@
 
 import org.eclipse.jdt.internal.ui.IJavaStatusConstants;
 import org.eclipse.jdt.internal.ui.JavaPlugin;
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
 
 /**
  * Reads data from an InputStream and returns a JarPackage
@@ -120,7 +121,7 @@
 	}
 
 	public JarPackageData readXML(JarPackageData jarPackage) throws IOException, SAXException {
-	  	DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+	  	DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
     	factory.setValidating(false);
 		DocumentBuilder parser= null;
 
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/jarpackager/JarPackageWriter.java	2024-03-19 10:01:55.509762205 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/jarpackager/JarPackageWriter.java	2024-03-19 14:26:46.593234194 +0100
@@ -27,7 +27,6 @@
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
@@ -56,6 +55,7 @@
 
 import org.eclipse.jdt.internal.ui.IJavaStatusConstants;
 import org.eclipse.jdt.internal.ui.JavaPlugin;
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
 
 /**
  * Writes a JarPackage to an underlying OutputStream
@@ -97,7 +97,7 @@
 	public void writeXML(JarPackageData jarPackage) throws IOException {
 		Assert.isNotNull(jarPackage);
 		DocumentBuilder docBuilder= null;
-		DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 		factory.setValidating(false);
 		try {
 	    	docBuilder= factory.newDocumentBuilder();
@@ -119,7 +119,7 @@
 
 		try {
 			// Write the document to the stream
-			Transformer transformer=TransformerFactory.newInstance().newTransformer();
+			Transformer transformer= XmlProcessorFactoryJdtUi.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 			transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 			transformer.setOutputProperty(OutputKeys.ENCODING, fEncoding);
 			transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/jarpackagerfat/FatJarRsrcUrlAntExporter.java	2024-03-19 10:01:55.486428821 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/jarpackagerfat/FatJarRsrcUrlAntExporter.java	2024-03-19 14:26:46.593234194 +0100
@@ -31,7 +31,6 @@
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
@@ -44,6 +43,7 @@
 import org.eclipse.debug.core.ILaunchConfiguration;
 
 import org.eclipse.jdt.internal.ui.JavaPlugin;
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
 
 /**
  * Create an ANT script for a runnable JAR with class loader export. The script is generated based
@@ -82,7 +82,7 @@
 		String absJarname= absJarfile.toString();
 
 		DocumentBuilder docBuilder= null;
-		DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 		factory.setValidating(false);
 		try {
 			docBuilder= factory.newDocumentBuilder();
@@ -164,7 +164,7 @@
 
 		try {
 			// Write the document to the stream
-			Transformer transformer= TransformerFactory.newInstance().newTransformer();
+			Transformer transformer= XmlProcessorFactoryJdtUi.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 			transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 			transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8"); //$NON-NLS-1$
 			transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/jarpackagerfat/UnpackFatJarAntExporter.java	2024-03-19 10:01:55.486428821 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/jarpackagerfat/UnpackFatJarAntExporter.java	2024-03-19 14:26:46.593234194 +0100
@@ -27,7 +27,6 @@
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
@@ -39,6 +38,8 @@
 
 import org.eclipse.debug.core.ILaunchConfiguration;
 
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
+
 /**
  * @since 3.5
  */
@@ -54,7 +55,7 @@
 			String absJarname= absJarfile.toString();
 
 			DocumentBuilder docBuilder= null;
-			DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+			DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 			factory.setValidating(false);
 			try {
 				docBuilder= factory.newDocumentBuilder();
@@ -114,7 +115,7 @@
 
 			try {
 				// Write the document to the stream
-				Transformer transformer= TransformerFactory.newInstance().newTransformer();
+				Transformer transformer= XmlProcessorFactoryJdtUi.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 				transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 				transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8"); //$NON-NLS-1$
 				transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/jarpackagerfat/UnpackJarAntExporter.java	2024-03-19 10:01:55.486428821 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/jarpackagerfat/UnpackJarAntExporter.java	2024-03-19 14:26:46.593234194 +0100
@@ -28,7 +28,6 @@
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
@@ -40,6 +39,8 @@
 
 import org.eclipse.debug.core.ILaunchConfiguration;
 
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
+
 /**
  * Create an ANT script for a runnable JAR wit libraries in a sub-folder. The script is generated
  * based on the classpath of the selected launch-configuration.
@@ -60,7 +61,7 @@
 			String absSubfolder= absJarfile.removeLastSegments(1).append(subfolder).toString();
 
 			DocumentBuilder docBuilder= null;
-			DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+			DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 			factory.setValidating(false);
 			try {
 				docBuilder= factory.newDocumentBuilder();
@@ -147,7 +148,7 @@
 
 			try {
 				// Write the document to the stream
-				Transformer transformer= TransformerFactory.newInstance().newTransformer();
+				Transformer transformer= XmlProcessorFactoryJdtUi.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 				transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 				transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8"); //$NON-NLS-1$
 				transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/javadocexport/JavadocReader.java	2024-03-19 10:01:55.516428886 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/javadocexport/JavadocReader.java	2024-03-19 14:26:46.593234194 +0100
@@ -31,6 +31,8 @@
 
 import org.eclipse.core.runtime.Assert;
 
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
+
 
 /**
  * Reads data from an InputStream and returns a JarPackage
@@ -62,7 +64,7 @@
 
 	public Element readXML() throws IOException, SAXException {
 
-		DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 		factory.setValidating(false);
 		DocumentBuilder parser= null;
 		try {
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/javadocexport/JavadocWriter.java	2024-03-19 10:01:55.513095546 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/javadocexport/JavadocWriter.java	2024-03-19 14:32:20.630554782 +0100
@@ -26,7 +26,6 @@
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
@@ -45,6 +44,8 @@
 import org.eclipse.jdt.core.IJavaProject;
 import org.eclipse.jdt.core.IPackageFragment;
 
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
+
 public class JavadocWriter {
 
 	private static final char PATH_SEPARATOR= '/'; // use forward slash for all platforms
@@ -66,7 +67,7 @@
 	public Element createXML(JavadocOptionsManager store) throws ParserConfigurationException {
 
 		DocumentBuilder docBuilder= null;
-		DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 		factory.setValidating(false);
 		docBuilder= factory.newDocumentBuilder();
 		Document document= docBuilder.newDocument();
@@ -103,7 +104,7 @@
 	public static void writeDocument(Element javadocElement, String encoding, OutputStream outputStream) throws TransformerException {
 
 		// Write the document to the stream
-		Transformer transformer=TransformerFactory.newInstance().newTransformer();
+		Transformer transformer= XmlProcessorFactoryJdtUi.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 		transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 		transformer.setOutputProperty(OutputKeys.ENCODING, encoding);
 		transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/preferences/formatter/ProfileStore.java	2024-03-19 10:01:55.486428821 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/preferences/formatter/ProfileStore.java	2024-03-19 14:26:46.593234194 +0100
@@ -38,7 +38,6 @@
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
@@ -62,6 +61,7 @@
 import org.eclipse.jdt.internal.ui.JavaUIStatus;
 import org.eclipse.jdt.internal.ui.preferences.formatter.ProfileManager.CustomProfile;
 import org.eclipse.jdt.internal.ui.preferences.formatter.ProfileManager.Profile;
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
 
 
 /**
@@ -238,7 +238,7 @@
 
 		final ProfileDefaultHandler handler= new ProfileDefaultHandler();
 		try {
-		    final SAXParserFactory factory= SAXParserFactory.newInstance();
+		    final SAXParserFactory factory= XmlProcessorFactoryJdtUi.createSAXFactoryWithErrorOnDOCTYPE();
 			final SAXParser parser= factory.newSAXParser();
 			parser.parse(inputSource, handler);
 		} catch (SAXException | IOException | ParserConfigurationException e) {
@@ -278,7 +278,7 @@
 	public static void writeProfilesToStream(Collection<Profile> profiles, OutputStream stream, String encoding, IProfileVersioner profileVersioner) throws CoreException {
 
 		try {
-			final DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+			final DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 			final DocumentBuilder builder= factory.newDocumentBuilder();
 			final Document document= builder.newDocument();
 
@@ -295,7 +295,7 @@
 				}
 			}
 
-			Transformer transformer=TransformerFactory.newInstance().newTransformer();
+			Transformer transformer= XmlProcessorFactoryJdtUi.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 			transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 			transformer.setOutputProperty(OutputKeys.ENCODING, encoding);
 			transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/preferences/UserLibraryPreferencePage.java	2024-03-19 10:01:55.489762162 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/preferences/UserLibraryPreferencePage.java	2024-03-19 14:30:24.676994457 +0100
@@ -35,7 +35,6 @@
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
@@ -117,6 +116,7 @@
 import org.eclipse.jdt.internal.ui.JavaPlugin;
 import org.eclipse.jdt.internal.ui.dialogs.StatusInfo;
 import org.eclipse.jdt.internal.ui.util.ExceptionHandler;
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
 import org.eclipse.jdt.internal.ui.wizards.buildpaths.AccessRulesDialog;
 import org.eclipse.jdt.internal.ui.wizards.buildpaths.ArchiveFileFilter;
 import org.eclipse.jdt.internal.ui.wizards.buildpaths.BuildPathSupport;
@@ -567,7 +567,7 @@
 			OutputStream stream= new FileOutputStream(file);
 			try {
 				DocumentBuilder docBuilder= null;
-				DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+				DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 				factory.setValidating(false);
 				docBuilder= factory.newDocumentBuilder();
 				Document document= docBuilder.newDocument();
@@ -622,7 +622,7 @@
 				}
 
 				// Write the document to the stream
-				Transformer transformer=TransformerFactory.newInstance().newTransformer();
+				Transformer transformer= XmlProcessorFactoryJdtUi.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 				transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 				transformer.setOutputProperty(OutputKeys.ENCODING, encoding);
 				transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
@@ -649,7 +649,7 @@
 			InputStream stream= new FileInputStream(file);
 			Element cpElement;
 			try {
-				DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+				DocumentBuilder parser = XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE().newDocumentBuilder();
 				parser.setErrorHandler(new DefaultHandler());
 				cpElement = parser.parse(new InputSource(stream)).getDocumentElement();
 			} catch (SAXException | ParserConfigurationException e) {
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/text/java/ContentAssistHistory.java	2024-03-19 10:01:55.496428843 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/text/java/ContentAssistHistory.java	2024-03-19 14:26:46.593234194 +0100
@@ -34,7 +34,6 @@
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
@@ -62,6 +61,7 @@
 import org.eclipse.jdt.internal.ui.JavaPlugin;
 import org.eclipse.jdt.internal.ui.JavaUIException;
 import org.eclipse.jdt.internal.ui.JavaUIStatus;
+import org.eclipse.jdt.internal.ui.util.XmlProcessorFactoryJdtUi;
 
 /**
  * An LRU cache for code assist.
@@ -85,7 +85,7 @@
 
 		public void store(ContentAssistHistory history, StreamResult result) throws CoreException {
 			try {
-				DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
+				DocumentBuilderFactory factory= XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 				DocumentBuilder builder= factory.newDocumentBuilder();
 				Document document= builder.newDocument();
 
@@ -106,7 +106,7 @@
 					}
 				}
 
-				Transformer transformer=TransformerFactory.newInstance().newTransformer();
+				Transformer transformer= XmlProcessorFactoryJdtUi.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 				transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 				transformer.setOutputProperty(OutputKeys.ENCODING, "UTF-8"); //$NON-NLS-1$
 				transformer.setOutputProperty(OutputKeys.INDENT, "no"); //$NON-NLS-1$
@@ -121,7 +121,7 @@
 		public ContentAssistHistory load(InputSource source) throws CoreException {
 			Element root;
 			try {
-				DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+				DocumentBuilder parser = XmlProcessorFactoryJdtUi.createDocumentBuilderFactoryWithErrorOnDOCTYPE().newDocumentBuilder();
 				parser.setErrorHandler(new DefaultHandler());
 				root = parser.parse(source).getDocumentElement();
 			} catch (SAXException | ParserConfigurationException | IOException e) {
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/util/XmlProcessorFactoryJdtUi.java	1970-01-01 01:00:00.000000000 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui/ui/org/eclipse/jdt/internal/ui/util/XmlProcessorFactoryJdtUi.java	2024-03-19 14:26:46.593234194 +0100
@@ -0,0 +1,166 @@
+/*******************************************************************************
+ *  Copyright (c) 2023 Joerg Kubitz and others.
+ *
+ *  This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License 2.0
+ *  which accompanies this distribution, and is available at
+ *  https://www.eclipse.org/legal/epl-2.0/
+ *
+ *  SPDX-License-Identifier: EPL-2.0
+ *******************************************************************************/
+package org.eclipse.jdt.internal.ui.util;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.TransformerFactory;
+
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+
+/**
+ * XML processing which prohibits external entities.
+ *
+ * @see <a href="https://rules.sonarsource.com/java/RSPEC-2755/">RSPEC-2755</a>
+ */
+public class XmlProcessorFactoryJdtUi {
+	private XmlProcessorFactoryJdtUi() {
+		// static Utility only
+	}
+
+	private static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE = createDocumentBuilderFactoryWithErrorOnDOCTYPE();
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE = createSAXFactoryWithErrorOnDOCTYPE(false);
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE_NS = createSAXFactoryWithErrorOnDOCTYPE(true);
+	private static final SAXParserFactory SAX_FACTORY_IGNORING_DOCTYPE = createSAXFactoryIgnoringDOCTYPE();
+
+	/**
+	 * Creates TransformerFactory which throws TransformerException when
+	 * detecting external entities.
+	 *
+	 * @return javax.xml.transform.TransformerFactory
+	 */
+	public static TransformerFactory createTransformerFactoryWithErrorOnDOCTYPE() {
+		TransformerFactory factory = TransformerFactory.newInstance();
+		// prohibit the use of all protocols by external entities:
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); //$NON-NLS-1$
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when
+	 * detecting external entities. It's magnitudes faster to call
+	 * {@link #createDocumentBuilderWithErrorOnDOCTYPE()}.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static synchronized DocumentBuilderFactory createDocumentBuilderFactoryWithErrorOnDOCTYPE() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		// completely disable DOCTYPE declaration:
+		try {
+			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (ParserConfigurationException e) {
+			throw new RuntimeException(e.getMessage(), e);
+		}
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilder which throws SAXParseException when detecting
+	 * external entities. The builder is not thread safe.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilder
+	 * @throws ParserConfigurationException
+	 */
+	public static DocumentBuilder createDocumentBuilderWithErrorOnDOCTYPE() throws ParserConfigurationException {
+		return DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE.newDocumentBuilder();
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when
+	 * detecting external entities.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE() {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		try {
+			// force org.xml.sax.SAXParseException for any DOCTYPE:
+			f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	private static synchronized SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE(boolean awareness) {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		f.setNamespaceAware(awareness);
+		try {
+			// force org.xml.sax.SAXParseException for any DOCTYPE:
+			f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	private static synchronized SAXParserFactory createSAXFactoryIgnoringDOCTYPE() {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		try {
+			// ignore DOCTYPE:
+			f.setFeature("http://xml.org/sax/features/external-general-entities", false); //$NON-NLS-1$
+			f.setFeature("http://xml.org/sax/features/external-parameter-entities", false); //$NON-NLS-1$
+			f.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	/**
+	 * Creates SAXParser which throws SAXParseException when detecting external
+	 * entities.
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+
+	public static SAXParser createSAXParserWithErrorOnDOCTYPE() throws ParserConfigurationException, SAXException {
+		return createSAXParserWithErrorOnDOCTYPE(false);
+	}
+
+	/**
+	 * Creates SAXParser which throws SAXParseException when detecting external
+	 * entities.
+	 *
+	 * @param namespaceAware
+	 *            parameter for SAXParserFactory
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+	public static SAXParser createSAXParserWithErrorOnDOCTYPE(boolean namespaceAware)
+			throws ParserConfigurationException, SAXException {
+		if (namespaceAware) {
+			return SAX_FACTORY_ERROR_ON_DOCTYPE_NS.newSAXParser();
+		}
+		return SAX_FACTORY_ERROR_ON_DOCTYPE.newSAXParser();
+	}
+
+	/**
+	 * Creates SAXParser which does not throw Exception when detecting external
+	 * entities but ignores them.
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+	public static SAXParser createSAXParserIgnoringDOCTYPE()
+			throws ParserConfigurationException, SAXNotRecognizedException, SAXNotSupportedException, SAXException {
+		SAXParser parser = SAX_FACTORY_IGNORING_DOCTYPE.newSAXParser();
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); //$NON-NLS-1$
+		return parser;
+	}
+}
\ No newline at end of file
--- a/eclipse.jdt.ui/org.eclipse.jdt.ui.tests/ui/org/eclipse/jdt/ui/tests/jarexport/FatJarExportTests.java	2024-03-19 10:01:55.436428713 +0100
+++ b/eclipse.jdt.ui/org.eclipse.jdt.ui.tests/ui/org/eclipse/jdt/ui/tests/jarexport/FatJarExportTests.java	2024-03-19 14:26:46.589900854 +0100
@@ -28,7 +28,6 @@
 import java.util.zip.ZipFile;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 
 import junit.framework.Test;
 import junit.framework.TestCase;
@@ -73,6 +72,7 @@
 import org.eclipse.jdt.core.JavaCore;
 
 import org.eclipse.jdt.internal.corext.util.JavaModelUtil;
+import org.eclipse.jdt.internal.junit.util.XmlProcessorFactoryJdtJunit;
 
 import org.eclipse.jdt.launching.IJavaLaunchConfigurationConstants;
 import org.eclipse.jdt.launching.IVMInstall;
@@ -664,7 +664,7 @@
 	 */
 	private static Element readXML(IPath xmlFilePath) throws Exception {
 		try (InputStream in = new FileInputStream(xmlFilePath.toFile())) {
-			DocumentBuilder parser= DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			DocumentBuilder parser= XmlProcessorFactoryJdtJunit.createDocumentBuilderFactoryWithErrorOnDOCTYPE().newDocumentBuilder();
 			parser.setErrorHandler(new DefaultHandler());
 			Element root= parser.parse(new InputSource(in)).getDocumentElement();
 			in.close();
--- a/eclipse.jdt.ui/org.eclipse.ltk.core.refactoring/src/org/eclipse/ltk/internal/core/refactoring/history/RefactoringHistoryManager.java	2024-03-19 10:01:55.423095351 +0100
+++ b/eclipse.jdt.ui/org.eclipse.ltk.core.refactoring/src/org/eclipse/ltk/internal/core/refactoring/history/RefactoringHistoryManager.java	2024-03-19 14:26:46.593234194 +0100
@@ -39,7 +39,6 @@
 import java.util.TimeZone;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.xml.sax.InputSource;
@@ -84,6 +83,7 @@
 import org.eclipse.ltk.internal.core.refactoring.RefactoringCorePlugin;
 import org.eclipse.ltk.internal.core.refactoring.RefactoringSessionReader;
 import org.eclipse.ltk.internal.core.refactoring.RefactoringSessionTransformer;
+import org.eclipse.ltk.internal.core.refactoring.XmlProcessorFactoryLtk;
 
 /**
  * Manager for persistable refactoring histories.
@@ -906,7 +906,7 @@
 	private Document getCachedDocument(final IPath path, final InputStream input) throws SAXException, IOException, ParserConfigurationException {
 		if (path.equals(fCachedPath) && fCachedDocument != null)
 			return fCachedDocument;
-		DocumentBuilder parser= DocumentBuilderFactory.newInstance().newDocumentBuilder();
+		DocumentBuilder parser= XmlProcessorFactoryLtk.createDocumentBuilderFactoryWithErrorOnDOCTYPE().newDocumentBuilder();
 		parser.setErrorHandler(new DefaultHandler());
 		final Document document= parser.parse(new InputSource(input));
 		fCachedDocument= document;
--- a/eclipse.jdt.ui/org.eclipse.ltk.core.refactoring/src/org/eclipse/ltk/internal/core/refactoring/RefactoringSessionReader.java	2024-03-19 10:01:55.423095351 +0100
+++ b/eclipse.jdt.ui/org.eclipse.ltk.core.refactoring/src/org/eclipse/ltk/internal/core/refactoring/RefactoringSessionReader.java	2024-03-19 14:26:46.593234194 +0100
@@ -136,7 +136,7 @@
 		fSessionFound= false;
 		try {
 			source.setSystemId("/"); //$NON-NLS-1$
-			createParser(SAXParserFactory.newInstance()).parse(source, this);
+			createParser(XmlProcessorFactoryLtk.createSAXFactoryWithErrorOnDOCTYPE()).parse(source, this);
 			if (!fSessionFound)
 				throw new CoreException(new Status(IStatus.ERROR, RefactoringCorePlugin.getPluginId(), IRefactoringCoreStatusCodes.REFACTORING_HISTORY_FORMAT_ERROR, RefactoringCoreMessages.RefactoringSessionReader_no_session, null));
 			if (fRefactoringDescriptors != null) {
--- a/eclipse.jdt.ui/org.eclipse.ltk.core.refactoring/src/org/eclipse/ltk/internal/core/refactoring/RefactoringSessionTransformer.java	2024-03-19 10:01:55.423095351 +0100
+++ b/eclipse.jdt.ui/org.eclipse.ltk.core.refactoring/src/org/eclipse/ltk/internal/core/refactoring/RefactoringSessionTransformer.java	2024-03-19 14:26:46.593234194 +0100
@@ -19,7 +19,6 @@
 import java.util.Iterator;
 import java.util.List;
 
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 
@@ -138,7 +137,7 @@
 		Assert.isTrue(flags >= RefactoringDescriptor.NONE);
 		try {
 			if (fDocument == null)
-				fDocument= DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument();
+				fDocument= XmlProcessorFactoryLtk.createDocumentBuilderFactoryWithErrorOnDOCTYPE().newDocumentBuilder().newDocument();
 		} catch (ParserConfigurationException | FactoryConfigurationError exception) {
 			throw new CoreException(new Status(IStatus.ERROR, RefactoringCorePlugin.getPluginId(), IRefactoringCoreStatusCodes.REFACTORING_HISTORY_IO_ERROR, exception.getLocalizedMessage(), null));
 		}
@@ -203,7 +202,7 @@
 	public void beginSession(final String comment, final String version) throws CoreException {
 		if (fDocument == null) {
 			try {
-				fDocument= DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument();
+				fDocument= XmlProcessorFactoryLtk.createDocumentBuilderFactoryWithErrorOnDOCTYPE().newDocumentBuilder().newDocument();
 				fSession= fDocument.createElement(IRefactoringSerializationConstants.ELEMENT_SESSION);
 				fSessionArguments= new ArrayList<>(2);
 				Attr attribute= fDocument.createAttribute(IRefactoringSerializationConstants.ATTRIBUTE_VERSION);
--- a/eclipse.jdt.ui/org.eclipse.ltk.core.refactoring/src/org/eclipse/ltk/internal/core/refactoring/XmlProcessorFactoryLtk.java	1970-01-01 01:00:00.000000000 +0100
+++ b/eclipse.jdt.ui/org.eclipse.ltk.core.refactoring/src/org/eclipse/ltk/internal/core/refactoring/XmlProcessorFactoryLtk.java	2024-03-19 14:26:46.593234194 +0100
@@ -0,0 +1,166 @@
+/*******************************************************************************
+ *  Copyright (c) 2023 Joerg Kubitz and others.
+ *
+ *  This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License 2.0
+ *  which accompanies this distribution, and is available at
+ *  https://www.eclipse.org/legal/epl-2.0/
+ *
+ *  SPDX-License-Identifier: EPL-2.0
+ *******************************************************************************/
+package org.eclipse.ltk.internal.core.refactoring;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.TransformerFactory;
+
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+
+/**
+ * XML processing which prohibits external entities.
+ *
+ * @see <a href="https://rules.sonarsource.com/java/RSPEC-2755/">RSPEC-2755</a>
+ */
+public class XmlProcessorFactoryLtk {
+	private XmlProcessorFactoryLtk() {
+		// static Utility only
+	}
+
+	private static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE = createDocumentBuilderFactoryWithErrorOnDOCTYPE();
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE = createSAXFactoryWithErrorOnDOCTYPE(false);
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE_NS = createSAXFactoryWithErrorOnDOCTYPE(true);
+	private static final SAXParserFactory SAX_FACTORY_IGNORING_DOCTYPE = createSAXFactoryIgnoringDOCTYPE();
+
+	/**
+	 * Creates TransformerFactory which throws TransformerException when
+	 * detecting external entities.
+	 *
+	 * @return javax.xml.transform.TransformerFactory
+	 */
+	public static TransformerFactory createTransformerFactoryWithErrorOnDOCTYPE() {
+		TransformerFactory factory = TransformerFactory.newInstance();
+		// prohibit the use of all protocols by external entities:
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); //$NON-NLS-1$
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when
+	 * detecting external entities. It's magnitudes faster to call
+	 * {@link #createDocumentBuilderWithErrorOnDOCTYPE()}.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static synchronized DocumentBuilderFactory createDocumentBuilderFactoryWithErrorOnDOCTYPE() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		// completely disable DOCTYPE declaration:
+		try {
+			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (ParserConfigurationException e) {
+			throw new RuntimeException(e.getMessage(), e);
+		}
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilder which throws SAXParseException when detecting
+	 * external entities. The builder is not thread safe.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilder
+	 * @throws ParserConfigurationException
+	 */
+	public static DocumentBuilder createDocumentBuilderWithErrorOnDOCTYPE() throws ParserConfigurationException {
+		return DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE.newDocumentBuilder();
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when
+	 * detecting external entities.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE() {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		try {
+			// force org.xml.sax.SAXParseException for any DOCTYPE:
+			f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	private static synchronized SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE(boolean awareness) {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		f.setNamespaceAware(awareness);
+		try {
+			// force org.xml.sax.SAXParseException for any DOCTYPE:
+			f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	private static synchronized SAXParserFactory createSAXFactoryIgnoringDOCTYPE() {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		try {
+			// ignore DOCTYPE:
+			f.setFeature("http://xml.org/sax/features/external-general-entities", false); //$NON-NLS-1$
+			f.setFeature("http://xml.org/sax/features/external-parameter-entities", false); //$NON-NLS-1$
+			f.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	/**
+	 * Creates SAXParser which throws SAXParseException when detecting external
+	 * entities.
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+
+	public static SAXParser createSAXParserWithErrorOnDOCTYPE() throws ParserConfigurationException, SAXException {
+		return createSAXParserWithErrorOnDOCTYPE(false);
+	}
+
+	/**
+	 * Creates SAXParser which throws SAXParseException when detecting external
+	 * entities.
+	 *
+	 * @param namespaceAware
+	 *            parameter for SAXParserFactory
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+	public static SAXParser createSAXParserWithErrorOnDOCTYPE(boolean namespaceAware)
+			throws ParserConfigurationException, SAXException {
+		if (namespaceAware) {
+			return SAX_FACTORY_ERROR_ON_DOCTYPE_NS.newSAXParser();
+		}
+		return SAX_FACTORY_ERROR_ON_DOCTYPE.newSAXParser();
+	}
+
+	/**
+	 * Creates SAXParser which does not throw Exception when detecting external
+	 * entities but ignores them.
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+	public static SAXParser createSAXParserIgnoringDOCTYPE()
+			throws ParserConfigurationException, SAXNotRecognizedException, SAXNotSupportedException, SAXException {
+		SAXParser parser = SAX_FACTORY_IGNORING_DOCTYPE.newSAXParser();
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); //$NON-NLS-1$
+		return parser;
+	}
+}
\ No newline at end of file
--- a/eclipse.pde.build/org.eclipse.pde.build/src_ant/org/eclipse/pde/internal/build/tasks/JNLPGenerator.java	2024-03-19 10:01:54.569760179 +0100
+++ b/eclipse.pde.build/org.eclipse.pde.build/src_ant/org/eclipse/pde/internal/build/tasks/JNLPGenerator.java	2024-03-19 12:46:16.971563577 +0100
@@ -46,7 +46,6 @@
 	 * feature.includes = extension
 	 * feature.plugin = jar
 	 */
-	private final static SAXParserFactory parserFactory = SAXParserFactory.newInstance();
 	private PrintWriter out;
 	private String destination;
 	private String provider;
@@ -89,8 +88,7 @@
 		this.locale = locale;
 		this.generateOfflineAllowed = generateOfflineAllowed;
 		try {
-			parserFactory.setNamespaceAware(true);
-			parser = parserFactory.newSAXParser();
+			parser = XmlParserFactory.createNsAwareSAXParserWithErrorOnDOCTYPE();;
 		} catch (ParserConfigurationException e) {
 			System.out.println(e);
 		} catch (SAXException e) {
--- a/eclipse.pde.build/org.eclipse.pde.build/src_ant/org/eclipse/pde/internal/build/tasks/XmlParserFactory.java	1970-01-01 01:00:00.000000000 +0100
+++ b/eclipse.pde.build/org.eclipse.pde.build/src_ant/org/eclipse/pde/internal/build/tasks/XmlParserFactory.java	2024-03-19 12:44:11.157984851 +0100
@@ -0,0 +1,42 @@
+/*******************************************************************************
+ *  Copyright (c) 2023 Joerg Kubitz and others.
+ *
+ *  This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License 2.0
+ *  which accompanies this distribution, and is available at
+ *  https://www.eclipse.org/legal/epl-2.0/
+ *
+ *  SPDX-License-Identifier: EPL-2.0
+ *******************************************************************************/
+package org.eclipse.pde.internal.build.tasks;
+
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+
+import org.xml.sax.SAXException;
+
+public class XmlParserFactory {
+	private XmlParserFactory() {
+		// static Utility only
+	}
+
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE_NS = createSAXFactoryWithErrorOnDOCTYPE();
+
+	private static synchronized SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE() {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		f.setNamespaceAware(true);
+		try {
+			// force org.xml.sax.SAXParseException for any DOCTYPE:
+			f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	public static SAXParser createNsAwareSAXParserWithErrorOnDOCTYPE() throws ParserConfigurationException, SAXException {
+		return SAX_FACTORY_ERROR_ON_DOCTYPE_NS.newSAXParser();
+	}
+
+}
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/ApiBaselineManager.java	2024-03-19 10:01:54.273092873 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/ApiBaselineManager.java	2024-03-20 09:29:06.196226859 +0100
@@ -31,7 +31,6 @@
 import java.util.Set;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 
@@ -61,6 +60,7 @@
 import org.eclipse.pde.core.plugin.ModelEntry;
 import org.eclipse.pde.core.plugin.PluginRegistry;
 import org.eclipse.pde.internal.core.DependencyManager;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
@@ -426,7 +426,7 @@
 		long start = System.currentTimeMillis();
 		DocumentBuilder parser = null;
 		try {
-			parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			parser = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			parser.setErrorHandler(new DefaultHandler());
 		} catch (ParserConfigurationException | FactoryConfigurationError e) {
 			abort("Error restoring API baseline", e); //$NON-NLS-1$
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/APIFileGenerator.java	2024-03-19 10:01:54.273092873 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/APIFileGenerator.java	2024-03-19 13:23:43.742521888 +0100
@@ -32,10 +32,8 @@
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
 
-import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.eclipse.core.runtime.CoreException;
 import org.eclipse.jdt.core.JavaCore;
@@ -48,6 +46,7 @@
 import org.eclipse.pde.api.tools.internal.provisional.model.IApiTypeContainer;
 import org.eclipse.pde.api.tools.internal.provisional.scanner.TagScanner;
 import org.eclipse.pde.api.tools.internal.util.Util;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.osgi.framework.BundleException;
 import org.osgi.framework.Constants;
 import org.xml.sax.Attributes;
@@ -459,15 +458,9 @@
 	 * @return true if it contains a source extension point, false otherwise
 	 */
 	private boolean containsAPIToolsNature(String pluginXMLContents) {
-		SAXParserFactory factory = null;
-		try {
-			factory = SAXParserFactory.newInstance();
-		} catch (FactoryConfigurationError e) {
-			return false;
-		}
 		SAXParser saxParser = null;
 		try {
-			saxParser = factory.newSAXParser();
+			saxParser = PDEXmlProcessorFactory.createSAXParserIgnoringDOCTYPE();
 		} catch (ParserConfigurationException | SAXException e) {
 			// ignore
 		}
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/model/BundleComponent.java	2024-03-19 10:01:54.273092873 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/model/BundleComponent.java	2024-03-20 08:58:08.409268636 +0100
@@ -36,10 +36,8 @@
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipFile;
 
-import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.eclipse.core.runtime.CoreException;
 import org.eclipse.core.runtime.IStatus;
@@ -80,6 +78,7 @@
 import org.eclipse.pde.api.tools.internal.util.Util;
 import org.eclipse.pde.internal.core.TargetWeaver;
 import org.eclipse.pde.internal.core.util.ManifestUtils;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.osgi.framework.BundleException;
 import org.osgi.framework.Constants;
 import org.osgi.framework.Version;
@@ -1057,15 +1056,9 @@
 	 * @return true if it contains a source extension point, false otherwise
 	 */
 	private boolean containsSourceExtensionPoint(String pluginXMLContents) {
-		SAXParserFactory factory = null;
-		try {
-			factory = SAXParserFactory.newInstance();
-		} catch (FactoryConfigurationError e) {
-			return false;
-		}
 		SAXParser saxParser = null;
 		try {
-			saxParser = factory.newSAXParser();
+			saxParser = PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 		} catch (ParserConfigurationException | SAXException e) {
 			// ignore
 		}
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/search/UseReportConverter.java	2024-03-19 10:01:54.276426214 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/search/UseReportConverter.java	2024-03-20 10:16:44.000012562 +0100
@@ -38,7 +38,6 @@
 
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 import javax.xml.transform.Result;
 import javax.xml.transform.Source;
 import javax.xml.transform.Transformer;
@@ -67,6 +66,7 @@
 import org.eclipse.pde.api.tools.internal.provisional.search.IMetadata;
 import org.eclipse.pde.api.tools.internal.util.Signatures;
 import org.eclipse.pde.api.tools.internal.util.Util;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.osgi.framework.Version;
 import org.w3c.dom.Element;
 import org.w3c.dom.NamedNodeMap;
@@ -778,9 +778,8 @@
 	 */
 	SAXParser getParser() throws Exception {
 		if (this.parser == null) {
-			SAXParserFactory factory = SAXParserFactory.newInstance();
 			try {
-				this.parser = factory.newSAXParser();
+				this.parser = PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 			} catch (ParserConfigurationException pce) {
 				throw new Exception(SearchMessages.UseReportConverter_pce_error_getting_parser, pce);
 			} catch (SAXException se) {
@@ -858,7 +857,7 @@
 	protected void applyXSLT(Source xslt, File xmlfile, File htmlfile) throws TransformerException {
 		Source xml = new StreamSource(xmlfile);
 		Result html = new StreamResult(htmlfile);
-		TransformerFactory factory = TransformerFactory.newInstance();
+		TransformerFactory factory = PDEXmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
 		Transformer former = factory.newTransformer(xslt);
 		former.transform(xml, html);
 	}
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/search/UseScanParser.java	2024-03-19 10:01:54.276426214 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/search/UseScanParser.java	2024-03-20 08:58:08.412601975 +0100
@@ -24,7 +24,6 @@
 
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.eclipse.core.runtime.IProgressMonitor;
 import org.eclipse.core.runtime.SubMonitor;
@@ -36,6 +35,7 @@
 import org.eclipse.pde.api.tools.internal.provisional.descriptors.IComponentDescriptor;
 import org.eclipse.pde.api.tools.internal.provisional.descriptors.IMemberDescriptor;
 import org.eclipse.pde.api.tools.internal.util.Util;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.xml.sax.Attributes;
 import org.xml.sax.SAXException;
 import org.xml.sax.helpers.DefaultHandler;
@@ -311,9 +311,9 @@
 	 *             builds
 	 */
 	SAXParser getParser() throws Exception {
-		SAXParserFactory factory = SAXParserFactory.newInstance();
 		try {
-			return factory.newSAXParser();
+			return PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
+
 		} catch (ParserConfigurationException pce) {
 			throw new Exception(SearchMessages.UseReportConverter_pce_error_getting_parser, pce);
 		} catch (SAXException se) {
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/search/XmlReferenceDescriptorWriter.java	2024-03-19 10:01:54.276426214 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/search/XmlReferenceDescriptorWriter.java	2024-03-20 10:19:14.850323527 +0100
@@ -27,7 +27,6 @@
 import java.util.Map.Entry;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 
@@ -46,6 +45,7 @@
 import org.eclipse.pde.api.tools.internal.provisional.model.IApiMember;
 import org.eclipse.pde.api.tools.internal.util.Signatures;
 import org.eclipse.pde.api.tools.internal.util.Util;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.NodeList;
@@ -86,7 +86,7 @@
 	public XmlReferenceDescriptorWriter(String location) {
 		fLocation = location;
 		try {
-			parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			parser = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			parser.setErrorHandler(new DefaultHandler());
 		} catch (FactoryConfigurationError | ParserConfigurationException pce) {
 			ApiPlugin.log(pce);
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/search/XmlSearchReporter.java	2024-03-19 10:01:54.276426214 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/search/XmlSearchReporter.java	2024-03-20 10:21:07.123888283 +0100
@@ -24,7 +24,6 @@
 import java.util.List;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 
@@ -40,6 +39,7 @@
 import org.eclipse.pde.api.tools.internal.provisional.search.IApiSearchReporter;
 import org.eclipse.pde.api.tools.internal.provisional.search.IMetadata;
 import org.eclipse.pde.api.tools.internal.util.Util;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.xml.sax.helpers.DefaultHandler;
@@ -69,7 +69,7 @@
 		fLocation = location;
 		this.debug = debug;
 		try {
-			parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			parser = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			parser.setErrorHandler(new DefaultHandler());
 		} catch (FactoryConfigurationError | ParserConfigurationException pce) {
 			ApiPlugin.log(pce);
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/util/Util.java	2024-03-19 10:01:54.273092873 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src/org/eclipse/pde/api/tools/internal/util/Util.java	2024-03-20 13:27:46.155319267 +0100
@@ -61,7 +61,6 @@
 import java.util.zip.ZipInputStream;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.OutputKeys;
@@ -141,6 +140,7 @@
 import org.eclipse.pde.api.tools.internal.provisional.problems.IApiProblem;
 import org.eclipse.pde.api.tools.internal.provisional.problems.IApiProblemTypes;
 import org.eclipse.pde.api.tools.internal.search.SkippedComponent;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.objectweb.asm.Opcodes;
 import org.osgi.framework.Version;
 import org.w3c.dom.Document;
@@ -1875,10 +1875,9 @@
 	 * @throws CoreException if unable to create a new document
 	 */
 	public static Document newDocument() throws CoreException {
-		DocumentBuilderFactory dfactory = DocumentBuilderFactory.newInstance();
 		DocumentBuilder docBuilder = null;
 		try {
-			docBuilder = dfactory.newDocumentBuilder();
+			docBuilder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 		} catch (ParserConfigurationException e) {
 			abort("Unable to create new XML document.", e); //$NON-NLS-1$
 		}
@@ -1898,7 +1897,7 @@
 		Element root = null;
 		InputStream stream = null;
 		try {
-			DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			DocumentBuilder parser = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			parser.setErrorHandler(new DefaultHandler());
 			stream = new ByteArrayInputStream(document.getBytes(StandardCharsets.UTF_8));
 			root = parser.parse(stream).getDocumentElement();
@@ -1989,7 +1988,7 @@
 	public static String serializeDocument(Document document) throws CoreException {
 		try {
 			ByteArrayOutputStream s = new ByteArrayOutputStream();
-			TransformerFactory factory = TransformerFactory.newInstance();
+			TransformerFactory factory = PDEXmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
 			Transformer transformer = factory.newTransformer();
 			transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 			transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src_ant/org/eclipse/pde/api/tools/internal/tasks/AnalysisReportConversionTask.java	2024-03-19 10:01:54.269759533 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src_ant/org/eclipse/pde/api/tools/internal/tasks/AnalysisReportConversionTask.java	2024-03-20 08:58:08.415935315 +0100
@@ -26,7 +26,6 @@
 
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.Task;
@@ -34,6 +33,7 @@
 import org.eclipse.pde.api.tools.internal.IApiXmlConstants;
 import org.eclipse.pde.api.tools.internal.provisional.ApiPlugin;
 import org.eclipse.pde.api.tools.internal.util.Util;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.xml.sax.Attributes;
 import org.xml.sax.SAXException;
 import org.xml.sax.helpers.DefaultHandler;
@@ -444,10 +444,9 @@
 		if (!this.reportsRoot.exists() || !this.reportsRoot.isDirectory()) {
 			throw new BuildException(NLS.bind(Messages.invalid_directory_name, this.xmlReportsLocation));
 		}
-		SAXParserFactory factory = SAXParserFactory.newInstance();
 		SAXParser parser = null;
 		try {
-			parser = factory.newSAXParser();
+			parser = PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 		} catch (ParserConfigurationException | SAXException e) {
 			e.printStackTrace();
 		}
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src_ant/org/eclipse/pde/api/tools/internal/tasks/APIDeprecationReportConversionTask.java	2024-03-19 10:01:54.269759533 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src_ant/org/eclipse/pde/api/tools/internal/tasks/APIDeprecationReportConversionTask.java	2024-03-20 08:58:08.415935315 +0100
@@ -25,7 +25,6 @@
 
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.Task;
@@ -34,6 +33,7 @@
 import org.eclipse.pde.api.tools.internal.IApiXmlConstants;
 import org.eclipse.pde.api.tools.internal.provisional.comparator.IDelta;
 import org.eclipse.pde.api.tools.internal.util.Util;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.xml.sax.Attributes;
 import org.xml.sax.SAXException;
 import org.xml.sax.helpers.DefaultHandler;
@@ -303,10 +303,9 @@
 			System.out.println("xmlFileLocation : " + this.xmlFileLocation); //$NON-NLS-1$
 			System.out.println("htmlFileLocation : " + this.htmlFileLocation); //$NON-NLS-1$
 		}
-		SAXParserFactory factory = SAXParserFactory.newInstance();
 		SAXParser parser = null;
 		try {
-			parser = factory.newSAXParser();
+			parser = PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 		} catch (ParserConfigurationException | SAXException e) {
 			e.printStackTrace();
 		}
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src_ant/org/eclipse/pde/api/tools/internal/tasks/APIFreezeReportConversionTask.java	2024-03-19 10:01:54.269759533 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools/src_ant/org/eclipse/pde/api/tools/internal/tasks/APIFreezeReportConversionTask.java	2024-03-20 08:58:08.415935315 +0100
@@ -25,7 +25,6 @@
 
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.Task;
@@ -34,6 +33,7 @@
 import org.eclipse.pde.api.tools.internal.IApiXmlConstants;
 import org.eclipse.pde.api.tools.internal.provisional.comparator.IDelta;
 import org.eclipse.pde.api.tools.internal.util.Util;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.xml.sax.Attributes;
 import org.xml.sax.SAXException;
 import org.xml.sax.helpers.DefaultHandler;
@@ -481,10 +481,9 @@
 				}
 			}
 		}
-		SAXParserFactory factory = SAXParserFactory.newInstance();
 		SAXParser parser = null;
 		try {
-			parser = factory.newSAXParser();
+			parser = PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 		} catch (ParserConfigurationException | SAXException e) {
 			e.printStackTrace();
 		}
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools.tests/src/org/eclipse/pde/api/tools/anttasks/tests/ApiToolingApiFreezeAntTaskTests.java	2024-03-19 10:01:54.363093068 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools.tests/src/org/eclipse/pde/api/tools/anttasks/tests/ApiToolingApiFreezeAntTaskTests.java	2024-03-20 10:27:19.504655851 +0100
@@ -22,12 +22,12 @@
 import java.util.Properties;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.eclipse.core.resources.IFile;
 import org.eclipse.core.resources.IFolder;
 import org.eclipse.core.runtime.CoreException;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.junit.Test;
 import org.w3c.dom.Document;
 import org.w3c.dom.Node;
@@ -62,7 +62,7 @@
 		IFile reportFile = buildFolder.getFile("report.xml"); //$NON-NLS-1$
 		assertTrue("report.xml must exist", reportFile.exists()); //$NON-NLS-1$
 		InputSource is = new InputSource(reportFile.getContents());
-		DocumentBuilder db = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+		DocumentBuilder db = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 		Document doc = db.parse(is);
 		NodeList elems = doc.getElementsByTagName("delta"); //$NON-NLS-1$
 		boolean found = false;
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools.tests/src/org/eclipse/pde/api/tools/anttasks/tests/ApiToolingApiuseAntTaskTests.java	2024-03-19 10:01:54.363093068 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools.tests/src/org/eclipse/pde/api/tools/anttasks/tests/ApiToolingApiuseAntTaskTests.java	2024-03-20 10:29:56.584979643 +0100
@@ -22,12 +22,12 @@
 import java.util.Properties;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.eclipse.core.resources.IFolder;
 import org.eclipse.core.resources.IResource;
 import org.eclipse.core.runtime.CoreException;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.junit.Test;
 import org.w3c.dom.Document;
 import org.w3c.dom.NodeList;
@@ -65,7 +65,7 @@
 	public void test1() throws Exception {
 		IFolder reportFolder = runTaskAndVerify("test1"); //$NON-NLS-1$
 		InputSource is = new InputSource(reportFolder.getFile("not_searched.xml").getContents()); //$NON-NLS-1$
-		DocumentBuilder db = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+		DocumentBuilder db = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 		Document doc = db.parse(is);
 
 		NodeList elems = doc.getElementsByTagName("component"); //$NON-NLS-1$
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools.tests/src/org/eclipse/pde/api/tools/anttasks/tests/ApiToolingCompareAntTaskTests.java	2024-03-19 10:01:54.363093068 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools.tests/src/org/eclipse/pde/api/tools/anttasks/tests/ApiToolingCompareAntTaskTests.java	2024-03-20 10:31:29.578504669 +0100
@@ -20,11 +20,11 @@
 import java.util.Properties;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.eclipse.core.resources.IFolder;
 import org.eclipse.core.runtime.CoreException;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.junit.Test;
 import org.w3c.dom.Document;
 import org.w3c.dom.NodeList;
@@ -59,7 +59,7 @@
 		assertTrue("report folder must exist", folder.exists()); //$NON-NLS-1$
 		assertTrue("report xml must exist", folder.getFile("compare.xml").exists()); //$NON-NLS-1$ //$NON-NLS-2$
 		InputSource is = new InputSource(folder.getFile("compare.xml").getContents()); //$NON-NLS-1$
-		DocumentBuilder db = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+		DocumentBuilder db = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 		Document doc = db.parse(is);
 		NodeList elems = doc.getElementsByTagName("delta"); //$NON-NLS-1$
 		boolean found = false;
--- a/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools.ui/src/org/eclipse/pde/api/tools/ui/internal/actions/ExportSessionAction.java	2024-03-19 10:01:54.286426235 +0100
+++ b/eclipse.pde.ui/apitools/org.eclipse.pde.api.tools.ui/src/org/eclipse/pde/api/tools/ui/internal/actions/ExportSessionAction.java	2024-03-20 10:35:34.392341472 +0100
@@ -45,6 +45,7 @@
 import org.eclipse.pde.api.tools.ui.internal.ApiUIPlugin;
 import org.eclipse.pde.api.tools.ui.internal.IApiToolsConstants;
 import org.eclipse.pde.api.tools.ui.internal.views.APIToolingView;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 
 /**
  * Drop-down action to select the active session.
@@ -155,8 +156,8 @@
 							writer = new BufferedWriter(new FileWriter(reportFile));
 							Result result = new StreamResult(writer);
 							// create an instance of TransformerFactory
-							TransformerFactory transFact = TransformerFactory.newInstance();
-							Transformer trans = transFact.newTransformer(xsltSource);
+							TransformerFactory f = PDEXmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
+							Transformer trans = f.newTransformer(xsltSource);
 							trans.transform(xmlSource, result);
 						} catch (TransformerException | IOException e) {
 							ApiUIPlugin.log(e);
--- a/eclipse.pde.ui/ds/org.eclipse.pde.ds.core/src/org/eclipse/pde/internal/ds/core/builders/XMLErrorReporter.java	2024-03-19 10:01:54.256426171 +0100
+++ b/eclipse.pde.ui/ds/org.eclipse.pde.ds.core/src/org/eclipse/pde/internal/ds/core/builders/XMLErrorReporter.java	2024-03-20 10:25:38.027780020 +0100
@@ -18,7 +18,6 @@
 import java.util.HashMap;
 import java.util.Stack;
 
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.eclipse.core.filebuffers.FileBuffers;
@@ -36,6 +35,7 @@
 import org.eclipse.jface.text.IRegion;
 import org.eclipse.jface.text.Position;
 import org.eclipse.pde.internal.core.builders.CompilerFlags;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.Element;
 import org.w3c.dom.Text;
 import org.xml.sax.Attributes;
@@ -168,10 +168,9 @@
 
 	@Override
 	public void startDocument() throws SAXException {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
 		try {
 			// TODO we should be using a dom level 2 impl
-			fXMLDocument = factory.newDocumentBuilder().newDocument();
+			PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 		} catch (ParserConfigurationException e) {
 		}
 	}
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/AbstractModel.java	2024-03-19 10:01:54.553093477 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/AbstractModel.java	2024-03-20 08:58:08.415935315 +0100
@@ -21,7 +21,6 @@
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 import org.eclipse.core.filebuffers.FileBuffers;
 import org.eclipse.core.filebuffers.ITextFileBuffer;
 import org.eclipse.core.filebuffers.ITextFileBufferManager;
@@ -38,6 +37,7 @@
 import org.eclipse.pde.core.IModelChangedEvent;
 import org.eclipse.pde.core.IModelChangedListener;
 import org.eclipse.pde.core.ModelChangedEvent;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.xml.sax.SAXException;
 
 public abstract class AbstractModel extends PlatformObject implements IModel, IModelChangeProviderExtension, Serializable {
@@ -195,7 +195,7 @@
 	}
 
 	protected SAXParser getSaxParser() throws ParserConfigurationException, SAXException, FactoryConfigurationError {
-		return SAXParserFactory.newInstance().newSAXParser();
+		return PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 	}
 
 	@Override
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/builders/BuildErrorReporter.java	2024-03-19 10:01:54.549760137 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/builders/BuildErrorReporter.java	2024-03-20 09:19:54.608431509 +0100
@@ -28,7 +28,6 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.xpath.XPath;
 import javax.xml.xpath.XPathConstants;
 import javax.xml.xpath.XPathFactory;
@@ -70,6 +69,7 @@
 import org.eclipse.pde.internal.core.text.build.BuildModel;
 import org.eclipse.pde.internal.core.util.CoreUtility;
 import org.eclipse.pde.internal.core.util.PatternConstructor;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.osgi.framework.Constants;
 import org.w3c.dom.Document;
 import org.w3c.dom.Node;
@@ -668,7 +668,7 @@
 	// if we're defining fragments, make sure they have entries in plugin.xml
 	private void validateFragmentContributions(IBuildEntry binIncludes) {
 		try {
-			DocumentBuilder newDocumentBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			DocumentBuilder newDocumentBuilder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			newDocumentBuilder.setErrorHandler(new PDEErrorHandler());
 			Document doc = newDocumentBuilder.parse(PDEProject.getPluginXml(fProject).getContents());
 			XPath xpath = XPathFactory.newInstance().newXPath();
@@ -684,7 +684,7 @@
 	// if we're defining an application, make sure it has entries in plugin.xml
 	private void validateApplicationContributions(IBuildEntry binIncludes) {
 		try {
-			DocumentBuilder newDocumentBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			DocumentBuilder newDocumentBuilder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			newDocumentBuilder.setErrorHandler(new PDEErrorHandler());
 			Document doc = newDocumentBuilder.parse(PDEProject.getPluginXml(fProject).getContents());
 			XPath xpath = XPathFactory.newInstance().newXPath();
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/builders/XMLErrorReporter.java	2024-03-19 10:01:54.549760137 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/builders/XMLErrorReporter.java	2024-03-20 09:21:51.335321249 +0100
@@ -18,7 +18,6 @@
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Stack;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import org.eclipse.core.filebuffers.FileBuffers;
 import org.eclipse.core.filebuffers.ITextFileBufferManager;
@@ -37,6 +36,7 @@
 import org.eclipse.pde.internal.core.PDECoreMessages;
 import org.eclipse.pde.internal.core.TargetPlatformHelper;
 import org.eclipse.pde.internal.core.builders.IncrementalErrorReporter.VirtualMarker;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
@@ -196,9 +196,8 @@
 
 	@Override
 	public void startDocument() throws SAXException {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
 		try {
-			fXMLDocument = factory.newDocumentBuilder().newDocument();
+			fXMLDocument = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 		} catch (ParserConfigurationException e) {
 		}
 	}
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/exports/FeatureExportOperation.java	2024-03-19 10:01:54.546426796 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/exports/FeatureExportOperation.java	2024-03-20 11:01:51.585498405 +0100
@@ -37,7 +37,6 @@
 import java.util.Map;
 import java.util.Properties;
 import java.util.Set;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 import org.eclipse.ant.core.AntCorePlugin;
@@ -96,6 +95,7 @@
 import org.eclipse.pde.internal.core.project.PDEProject;
 import org.eclipse.pde.internal.core.target.TargetMetadataCollector;
 import org.eclipse.pde.internal.core.util.CoreUtility;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.osgi.framework.InvalidSyntaxException;
 import org.w3c.dom.DOMException;
 import org.w3c.dom.Document;
@@ -205,8 +205,7 @@
 		try {
 			scriptFile = createScriptFile("append.xml"); //$NON-NLS-1$
 
-			DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-			Document doc = factory.newDocumentBuilder().newDocument();
+			Document doc = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 
 			Element root = doc.createElement("project"); //$NON-NLS-1$
 			root.setAttribute("name", "temp"); //$NON-NLS-1$ //$NON-NLS-2$
@@ -870,8 +869,7 @@
 		File scriptFile = null;
 		try {
 			scriptFile = createScriptFile("zip.xml"); //$NON-NLS-1$
-			DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-			Document doc = factory.newDocumentBuilder().newDocument();
+			Document doc = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 
 			Element root = doc.createElement("project"); //$NON-NLS-1$
 			root.setAttribute("name", "temp"); //$NON-NLS-1$ //$NON-NLS-2$
@@ -942,8 +940,7 @@
 	private void createFeature(String featureID, String featureLocation, Object[] featuresExported, Document doc, Element root, Properties prop) throws IOException {
 		try {
 			if (doc == null) {
-				DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-				doc = factory.newDocumentBuilder().newDocument();
+				doc = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 				root = doc.createElement("feature"); //$NON-NLS-1$
 				root.setAttribute("id", featureID); //$NON-NLS-1$
 				root.setAttribute("version", "1.0"); //$NON-NLS-1$ //$NON-NLS-2$
@@ -1048,8 +1045,7 @@
 		}
 
 		try {
-			DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-			Document doc = factory.newDocumentBuilder().newDocument();
+			Document doc = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 			Element root = doc.createElement("feature"); //$NON-NLS-1$
 			root.setAttribute("id", featureID); //$NON-NLS-1$
 			root.setAttribute("version", "1.0"); //$NON-NLS-1$ //$NON-NLS-2$
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/PDEAuxiliaryState.java	2024-03-19 10:01:54.543093455 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/PDEAuxiliaryState.java	2024-03-20 10:58:55.251809821 +0100
@@ -20,7 +20,6 @@
 import java.util.Iterator;
 import java.util.Map;
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 import org.eclipse.osgi.service.resolver.BundleDescription;
@@ -31,6 +30,7 @@
 import org.eclipse.pde.core.plugin.IPluginModelBase;
 import org.eclipse.pde.internal.core.ibundle.IBundleModel;
 import org.eclipse.pde.internal.core.ibundle.IBundlePluginModelBase;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.osgi.framework.BundleException;
 import org.osgi.framework.Constants;
 import org.w3c.dom.Document;
@@ -194,8 +194,7 @@
 	 */
 	protected void savePluginInfo(File dir) {
 		try {
-			DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-			Document doc = factory.newDocumentBuilder().newDocument();
+			Document doc = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 			Element root = doc.createElement(ELEMENT_ROOT);
 
 			Iterator<String> iter = fPluginInfos.keySet().iterator();
@@ -254,8 +253,7 @@
 		File file = new File(dir, CACHE_EXTENSION);
 		if (file.exists() && file.isFile()) {
 			try {
-				DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-				DocumentBuilder documentBuilder = factory.newDocumentBuilder();
+				DocumentBuilder documentBuilder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 				documentBuilder.setErrorHandler(new DefaultHandler());
 				Document doc = documentBuilder.parse(file);
 				Element root = doc.getDocumentElement();
@@ -294,7 +292,7 @@
 	 */
 	public static void writePluginInfo(IPluginModelBase[] models, File destination) {
 		try {
-			DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			DocumentBuilder builder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			Document doc = builder.newDocument();
 
 			Element root = doc.createElement(ELEMENT_ROOT);
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/plugin/AbstractExtensions.java	2024-03-19 10:01:54.549760137 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/plugin/AbstractExtensions.java	2024-03-20 08:58:08.419268655 +0100
@@ -22,7 +22,6 @@
 import java.util.Collections;
 import java.util.List;
 import javax.xml.parsers.ParserConfigurationException;
-import javax.xml.parsers.SAXParserFactory;
 import org.eclipse.core.resources.IFile;
 import org.eclipse.core.runtime.CoreException;
 import org.eclipse.pde.core.IModelChangedEvent;
@@ -34,6 +33,7 @@
 import org.eclipse.pde.core.plugin.ISharedPluginModel;
 import org.eclipse.pde.internal.core.PDECore;
 import org.eclipse.pde.internal.core.PDECoreMessages;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.Node;
 import org.xml.sax.SAXException;
 
@@ -197,7 +197,7 @@
 					try {
 						InputStream stream = new BufferedInputStream(((IFile) res).getContents(true));
 						PluginHandler handler = new PluginHandler(true);
-						SAXParserFactory.newInstance().newSAXParser().parse(stream, handler);
+						PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE().parse(stream, handler);
 						return handler.getSchemaVersion();
 					} catch (CoreException | SAXException | IOException | ParserConfigurationException e) {
 					}
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/plugin/PluginBase.java	2024-03-19 10:01:54.549760137 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/plugin/PluginBase.java	2024-03-20 08:58:08.419268655 +0100
@@ -19,7 +19,6 @@
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 import org.eclipse.core.runtime.CoreException;
 import org.eclipse.osgi.service.resolver.BundleDescription;
 import org.eclipse.osgi.service.resolver.BundleSpecification;
@@ -34,6 +33,7 @@
 import org.eclipse.pde.internal.core.PDECoreMessages;
 import org.eclipse.pde.internal.core.PDEState;
 import org.eclipse.pde.internal.core.bundle.BundlePluginBase;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.osgi.framework.Version;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
@@ -400,7 +400,8 @@
 	}
 
 	protected SAXParser getSaxParser() throws ParserConfigurationException, SAXException, FactoryConfigurationError {
-		return SAXParserFactory.newInstance().newSAXParser();
+		return PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
+
 	}
 
 	public static int getMatchRule(VersionRange versionRange) {
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/plugin/PluginHandler.java	2024-03-19 10:01:54.549760137 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/plugin/PluginHandler.java	2024-03-20 11:03:25.495687610 +0100
@@ -17,10 +17,10 @@
 import java.util.Stack;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import org.eclipse.pde.internal.core.TargetPlatformHelper;
 import org.eclipse.pde.internal.core.util.IdUtil;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.DOMException;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
@@ -97,9 +97,8 @@
 
 	@Override
 	public void startDocument() throws SAXException {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
 		try {
-			fDocument = factory.newDocumentBuilder().newDocument();
+			fDocument = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 		} catch (ParserConfigurationException e) {
 		}
 	}
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/target/IUBundleContainer.java	2024-03-19 10:01:54.546426796 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/target/IUBundleContainer.java	2024-03-20 10:44:30.320077119 +0100
@@ -66,6 +66,7 @@
 import org.eclipse.pde.core.target.TargetBundle;
 import org.eclipse.pde.core.target.TargetFeature;
 import org.eclipse.pde.internal.core.PDECore;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
@@ -696,7 +697,7 @@
 		Element containerElement;
 		Document document;
 		try {
-			DocumentBuilder docBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			DocumentBuilder docBuilder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			document = docBuilder.newDocument();
 		} catch (Exception e) {
 			PDECore.log(e);
@@ -729,7 +730,8 @@
 		try {
 			document.appendChild(containerElement);
 			StreamResult result = new StreamResult(new StringWriter());
-			Transformer transformer = TransformerFactory.newInstance().newTransformer();
+			TransformerFactory f = PDEXmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
+			Transformer transformer = f.newTransformer();
 			transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes"); //$NON-NLS-1$
 			transformer.transform(new DOMSource(document), result);
 			return result.getWriter().toString();
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/target/IULocationFactory.java	2024-03-19 10:01:54.546426796 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/target/IULocationFactory.java	2024-03-20 09:23:38.478859337 +0100
@@ -27,6 +27,7 @@
 import org.eclipse.pde.core.target.ITargetLocation;
 import org.eclipse.pde.core.target.ITargetLocationFactory;
 import org.eclipse.pde.internal.core.PDECore;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
@@ -45,7 +46,7 @@
 
 		Element location;
 		try {
-			DocumentBuilder docBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+			DocumentBuilder docBuilder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			Document document = docBuilder
 					.parse(new ByteArrayInputStream(serializedXML.getBytes(StandardCharsets.UTF_8)));
 			location = document.getDocumentElement();
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/target/TargetDefinition.java	2024-03-19 10:01:54.546426796 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/target/TargetDefinition.java	2024-03-20 10:48:11.437184806 +0100
@@ -32,7 +32,6 @@
 import java.util.Map.Entry;
 import java.util.Set;
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.TransformerException;
 import org.eclipse.core.runtime.CoreException;
@@ -60,6 +59,7 @@
 import org.eclipse.pde.internal.core.ICoreConstants;
 import org.eclipse.pde.internal.core.PDECore;
 import org.eclipse.pde.internal.core.TargetPlatformHelper;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.DOMException;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
@@ -133,8 +133,7 @@
 
 	private static Document createNewDocument() {
 		try {
-			DocumentBuilderFactory dfactory = DocumentBuilderFactory.newInstance();
-			DocumentBuilder docBuilder = dfactory.newDocumentBuilder();
+			DocumentBuilder docBuilder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			Document doc = docBuilder.newDocument();
 			ProcessingInstruction instruction = doc.createProcessingInstruction(
 					TargetDefinitionPersistenceHelper.PDE_INSTRUCTION,
@@ -1238,8 +1237,7 @@
 		List<Element> oldIUContainers = new ArrayList<>();
 		List<Element> oldGenericContainers = new ArrayList<>();
 
-		DocumentBuilderFactory dfactory = DocumentBuilderFactory.newInstance();
-		DocumentBuilder docBuilder = dfactory.newDocumentBuilder();
+		DocumentBuilder docBuilder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 		for (ITargetLocation targetLocation : targetLocations) {
 			String type = targetLocation.getType();
 			if (targetLocation instanceof DirectoryBundleContainer) {
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/target/TargetDefinitionPersistenceHelper.java	2024-03-19 10:01:54.546426796 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/target/TargetDefinitionPersistenceHelper.java	2024-03-20 10:38:02.182636244 +0100
@@ -22,7 +22,6 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
@@ -37,6 +36,7 @@
 import org.eclipse.pde.core.target.ITargetPlatformService;
 import org.eclipse.pde.internal.core.ICoreConstants;
 import org.eclipse.pde.internal.core.PDECore;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.DOMException;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
@@ -122,7 +122,7 @@
 			return;
 		}
 		StreamResult outputTarget = new StreamResult(output);
-		TransformerFactory factory = TransformerFactory.newInstance();
+		TransformerFactory factory = PDEXmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
 		Transformer transformer = factory.newTransformer();
 		transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 		transformer.setOutputProperty(OutputKeys.INDENT, "yes"); //$NON-NLS-1$
@@ -151,7 +151,7 @@
 	 */
 	public static void initFromXML(ITargetDefinition definition, InputStream input)
 			throws CoreException, ParserConfigurationException, SAXException, IOException {
-		DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+		DocumentBuilder parser = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 		parser.setErrorHandler(new DefaultHandler());
 		Document doc = parser.parse(new InputSource(input));
 
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/target/TargetPersistence38Helper.java	2024-03-19 10:01:54.546426796 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/target/TargetPersistence38Helper.java	2024-03-20 10:40:10.876226264 +0100
@@ -35,6 +35,7 @@
 import org.eclipse.pde.core.target.ITargetLocationFactory;
 import org.eclipse.pde.core.target.NameVersionDescriptor;
 import org.eclipse.pde.internal.core.PDECore;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
 import org.w3c.dom.NodeList;
@@ -246,7 +247,8 @@
 					throw new CoreException(new Status(IStatus.ERROR, PDECore.PLUGIN_ID, NLS.bind(Messages.TargetPersistence38Helper_NoTargetLocationExtension, type)));
 				}
 				StreamResult result = new StreamResult(new StringWriter());
-				Transformer transformer = TransformerFactory.newInstance().newTransformer();
+				TransformerFactory factory = PDEXmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
+				Transformer transformer = factory.newTransformer();
 				transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes"); //$NON-NLS-1$
 				transformer.transform(new DOMSource(location), result);
 				container = locFactory.getTargetLocation(type, result.getWriter().toString());
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/util/PDEXMLHelper.java	2024-03-19 10:01:54.546426796 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/util/PDEXMLHelper.java	2024-03-20 10:55:12.231360549 +0100
@@ -13,14 +13,7 @@
  *******************************************************************************/
 package org.eclipse.pde.internal.core.util;
 
-import java.lang.ref.SoftReference;
-import java.util.Collections;
-import java.util.LinkedList;
-import java.util.List;
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.FactoryConfigurationError;
-import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
 import javax.xml.parsers.SAXParserFactory;
 import org.xml.sax.SAXException;
@@ -31,56 +24,16 @@
  */
 public class PDEXMLHelper {
 
-	protected static SAXParserFactory fSAXFactory;
 	protected static PDEXMLHelper fPinstance;
-	protected static DocumentBuilderFactory fDOMFactory;
-	protected static List<SoftReference<SAXParser>> fSAXParserQueue;
-	protected static List<SoftReference<DocumentBuilder>> fDOMParserQueue;
 	protected static int fSAXPoolLimit;
 	protected static int fDOMPoolLimit;
 	protected static final int FMAXPOOLLIMIT = 1;
 
 	protected PDEXMLHelper() throws FactoryConfigurationError {
-		fSAXFactory = SAXParserFactory.newInstance();
-		fDOMFactory = DocumentBuilderFactory.newInstance();
-		fSAXParserQueue = Collections.synchronizedList(new LinkedList<SoftReference<SAXParser>>());
-		fDOMParserQueue = Collections.synchronizedList(new LinkedList<SoftReference<DocumentBuilder>>());
 		fSAXPoolLimit = FMAXPOOLLIMIT;
 		fDOMPoolLimit = FMAXPOOLLIMIT;
 	}
 
-	public synchronized SAXParser getDefaultSAXParser() throws ParserConfigurationException, SAXException {
-
-		SAXParser parser = null;
-		if (fSAXParserQueue.isEmpty()) {
-			parser = fSAXFactory.newSAXParser();
-		} else {
-			SoftReference<?> reference = fSAXParserQueue.remove(0);
-			if (reference.get() != null) {
-				parser = (SAXParser) reference.get();
-			} else {
-				parser = fSAXFactory.newSAXParser();
-			}
-		}
-		return parser;
-	}
-
-	public synchronized DocumentBuilder getDefaultDOMParser() throws ParserConfigurationException {
-
-		DocumentBuilder parser = null;
-		if (fDOMParserQueue.isEmpty()) {
-			parser = fDOMFactory.newDocumentBuilder();
-		} else {
-			SoftReference<?> reference = fDOMParserQueue.remove(0);
-			if (reference.get() != null) {
-				parser = (DocumentBuilder) reference.get();
-			} else {
-				parser = fDOMFactory.newDocumentBuilder();
-			}
-		}
-		return parser;
-	}
-
 	public static PDEXMLHelper Instance() throws FactoryConfigurationError {
 		if (fPinstance == null) {
 			fPinstance = new PDEXMLHelper();
@@ -88,20 +41,6 @@
 		return fPinstance;
 	}
 
-	public synchronized void recycleSAXParser(SAXParser parser) {
-		if (fSAXParserQueue.size() < fSAXPoolLimit) {
-			SoftReference<SAXParser> reference = new SoftReference<>(parser);
-			fSAXParserQueue.add(reference);
-		}
-	}
-
-	public synchronized void recycleDOMParser(DocumentBuilder parser) {
-		if (fDOMParserQueue.size() < fDOMPoolLimit) {
-			SoftReference<DocumentBuilder> reference = new SoftReference<>(parser);
-			fDOMParserQueue.add(reference);
-		}
-	}
-
 	public static String getWritableString(String source) {
 		if (source == null) {
 			return ""; //$NON-NLS-1$
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/util/PDEXmlProcessorFactory.java	1970-01-01 01:00:00.000000000 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/util/PDEXmlProcessorFactory.java	2024-03-20 08:58:08.422601994 +0100
@@ -0,0 +1,197 @@
+/*******************************************************************************
+ *  Copyright (c) 2023 Joerg Kubitz and others.
+ *
+ *  This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License 2.0
+ *  which accompanies this distribution, and is available at
+ *  https://www.eclipse.org/legal/epl-2.0/
+ *
+ *  SPDX-License-Identifier: EPL-2.0
+ *******************************************************************************/
+package org.eclipse.pde.internal.core.util;
+
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.TransformerFactory;
+
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+
+/**
+ * XML processing which prohibits external entities.
+ *
+ * @see <a href="https://rules.sonarsource.com/java/RSPEC-2755/">RSPEC-2755</a>
+ */
+public class PDEXmlProcessorFactory {
+	private PDEXmlProcessorFactory() {
+		// static Utility only
+	}
+
+	private static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE = createDocumentBuilderFactoryWithErrorOnDOCTYPE();
+	private static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY_IGNORING_DOCTYPE = createDocumentBuilderFactoryIgnoringDOCTYPE();
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE = createSAXFactoryWithErrorOnDOCTYPE(false);
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE_NS = createSAXFactoryWithErrorOnDOCTYPE(true);
+	private static final SAXParserFactory SAX_FACTORY_IGNORING_DOCTYPE = createSAXFactoryIgnoringDOCTYPE();
+
+	/**
+	 * Creates TransformerFactory which throws TransformerException when
+	 * detecting external entities.
+	 *
+	 * @return javax.xml.transform.TransformerFactory
+	 */
+	public static TransformerFactory createTransformerFactoryWithErrorOnDOCTYPE() {
+		TransformerFactory factory = TransformerFactory.newInstance();
+		// prohibit the use of all protocols by external entities:
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); //$NON-NLS-1$
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when
+	 * detecting external entities. It's magnitudes faster to call
+	 * {@link #createDocumentBuilderWithErrorOnDOCTYPE()}.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static synchronized DocumentBuilderFactory createDocumentBuilderFactoryWithErrorOnDOCTYPE() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		// completely disable DOCTYPE declaration:
+		try {
+			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (ParserConfigurationException e) {
+			throw new RuntimeException(e.getMessage(), e);
+		}
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which ignores external entities. It's
+	 * magnitudes faster to call
+	 * {@link #createDocumentBuilderIgnoringDOCTYPE()}.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static synchronized DocumentBuilderFactory createDocumentBuilderFactoryIgnoringDOCTYPE() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		try {
+			// completely disable external entities declarations:
+			factory.setFeature("http://xml.org/sax/features/external-general-entities", false); //$NON-NLS-1$
+			factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); //$NON-NLS-1$
+		} catch (ParserConfigurationException e) {
+			throw new RuntimeException(e.getMessage(), e);
+		}
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilder which throws SAXParseException when detecting
+	 * external entities. The builder is not thread safe.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilder
+	 * @throws ParserConfigurationException
+	 */
+	public static DocumentBuilder createDocumentBuilderWithErrorOnDOCTYPE() throws ParserConfigurationException {
+		return DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE.newDocumentBuilder();
+	}
+
+	/**
+	 * Creates DocumentBuilder which ignores external entities. The builder is
+	 * not thread safe.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilder
+	 * @throws ParserConfigurationException
+	 */
+	public static DocumentBuilder createDocumentBuilderIgnoringDOCTYPE() throws ParserConfigurationException {
+		return DOCUMENT_BUILDER_FACTORY_IGNORING_DOCTYPE.newDocumentBuilder();
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when
+	 * detecting external entities.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE() {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		try {
+			// force org.xml.sax.SAXParseException for any DOCTYPE:
+			f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	private static synchronized SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE(boolean awareness) {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		f.setNamespaceAware(awareness);
+		try {
+			// force org.xml.sax.SAXParseException for any DOCTYPE:
+			f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	private static synchronized SAXParserFactory createSAXFactoryIgnoringDOCTYPE() {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		try {
+			// ignore DOCTYPE:
+			f.setFeature("http://xml.org/sax/features/external-general-entities", false); //$NON-NLS-1$
+			f.setFeature("http://xml.org/sax/features/external-parameter-entities", false); //$NON-NLS-1$
+			f.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	/**
+	 * Creates SAXParser which throws SAXParseException when detecting external
+	 * entities.
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+
+	public static SAXParser createSAXParserWithErrorOnDOCTYPE() throws ParserConfigurationException, SAXException {
+		return createSAXParserWithErrorOnDOCTYPE(false);
+	}
+
+	/**
+	 * Creates SAXParser which throws SAXParseException when detecting external
+	 * entities.
+	 *
+	 * @param namespaceAware
+	 *            parameter for SAXParserFactory
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+	public static SAXParser createSAXParserWithErrorOnDOCTYPE(boolean namespaceAware)
+			throws ParserConfigurationException, SAXException {
+		if (namespaceAware) {
+			return SAX_FACTORY_ERROR_ON_DOCTYPE_NS.newSAXParser();
+		}
+		return SAX_FACTORY_ERROR_ON_DOCTYPE.newSAXParser();
+	}
+
+	/**
+	 * Creates SAXParser which does not throw Exception when detecting external
+	 * entities but ignores them.
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+	public static SAXParser createSAXParserIgnoringDOCTYPE()
+			throws ParserConfigurationException, SAXNotRecognizedException, SAXNotSupportedException, SAXException {
+		SAXParser parser = SAX_FACTORY_IGNORING_DOCTYPE.newSAXParser();
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); //$NON-NLS-1$
+		return parser;
+	}
+}
\ No newline at end of file
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/util/SAXParserWrapper.java	2024-03-19 10:01:54.546426796 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/util/SAXParserWrapper.java	2024-03-20 12:49:41.184414763 +0100
@@ -30,45 +31,25 @@
  */
 public class SAXParserWrapper {
 
-	protected SAXParser fParser;
-	protected boolean isdisposed;
-
-	/**
-	 *
-	 */
-	public SAXParserWrapper() throws ParserConfigurationException, SAXException, FactoryConfigurationError {
-		fParser = PDEXMLHelper.Instance().getDefaultSAXParser();
-		isdisposed = false;
+	public SAXParserWrapper() {
 	}
 
-	// Explicit disposal
-	public void dispose() {
-		if (isdisposed == false) {
-			PDEXMLHelper.Instance().recycleSAXParser(fParser);
-			isdisposed = true;
-		}
-	}
-
-	public void parse(File f, DefaultHandler dh) throws SAXException, IOException {
+	public void parse(File f, DefaultHandler dh)
+			throws SAXException, IOException, ParserConfigurationException, FactoryConfigurationError {
+		SAXParser fParser = PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 		fParser.parse(f, dh);
 	}
 
-	public void parse(InputStream is, DefaultHandler dh) throws SAXException, IOException {
+	public void parse(InputStream is, DefaultHandler dh)
+			throws SAXException, IOException, ParserConfigurationException, FactoryConfigurationError {
+		SAXParser fParser = PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 		fParser.parse(is, dh);
 	}
 
-	public void parse(InputSource is, DefaultHandler dh) throws SAXException, IOException {
+	public void parse(InputSource is, DefaultHandler dh)
+			throws SAXException, IOException, ParserConfigurationException, FactoryConfigurationError {
+		SAXParser fParser = PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
 		fParser.parse(is, dh);
 	}
 
-	// NOTE:  If other parser method calls are required, the corresponding
-	// wrapper method needs to be added here
-
-	// Implicit disposal
-	@Override
-	protected void finalize() throws Throwable {
-		super.finalize();
-		dispose();
-	}
-
 }
--- a/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/XMLDefaultHandler.java	2024-03-19 10:01:54.546426796 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.core/src/org/eclipse/pde/internal/core/XMLDefaultHandler.java	2024-03-20 11:05:15.339242277 +0100
@@ -15,8 +15,8 @@
 
 import java.io.StringReader;
 import java.util.Stack;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
 import org.w3c.dom.Text;
@@ -72,9 +72,8 @@
 
 	@Override
 	public void startDocument() throws SAXException {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
 		try {
-			fDocument = factory.newDocumentBuilder().newDocument();
+			fDocument = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 		} catch (ParserConfigurationException e) {
 		}
 	}
--- a/eclipse.pde.ui/ui/org.eclipse.pde.ui/src/org/eclipse/pde/internal/ui/wizards/exports/FeatureExportWizard.java	2024-03-19 10:01:54.506426709 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.ui/src/org/eclipse/pde/internal/ui/wizards/exports/FeatureExportWizard.java	2024-03-20 09:03:57.656602733 +0100
@@ -25,6 +25,7 @@
 import org.eclipse.pde.internal.core.exports.FeatureExportInfo;
 import org.eclipse.pde.internal.core.exports.FeatureExportOperation;
 import org.eclipse.pde.internal.core.ifeature.IFeatureModel;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.eclipse.pde.internal.ui.PDEPluginImages;
 import org.eclipse.pde.internal.ui.PDEUIMessages;
 import org.eclipse.pde.internal.ui.build.RuntimeInstallJob;
@@ -127,8 +128,7 @@
 	@Override
 	protected Document generateAntTask() {
 		try {
-			DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-			Document doc = factory.newDocumentBuilder().newDocument();
+			Document doc = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 			Element root = doc.createElement("project"); //$NON-NLS-1$
 			root.setAttribute("name", "build"); //$NON-NLS-1$ //$NON-NLS-2$
 			root.setAttribute("default", "feature_export"); //$NON-NLS-1$ //$NON-NLS-2$
--- a/eclipse.pde.ui/ui/org.eclipse.pde.ui/src/org/eclipse/pde/internal/ui/wizards/exports/PluginExportWizard.java	2024-03-19 10:01:54.506426709 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.ui/src/org/eclipse/pde/internal/ui/wizards/exports/PluginExportWizard.java	2024-03-20 09:06:09.673521693 +0100
@@ -21,6 +21,7 @@
 import org.eclipse.pde.core.plugin.IPluginModelBase;
 import org.eclipse.pde.internal.core.exports.FeatureExportInfo;
 import org.eclipse.pde.internal.core.exports.PluginExportOperation;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.eclipse.pde.internal.ui.PDEPluginImages;
 import org.eclipse.pde.internal.ui.PDEUIMessages;
 import org.eclipse.pde.internal.ui.build.RuntimeInstallJob;
@@ -97,8 +98,7 @@
 	@Override
 	protected Document generateAntTask() {
 		try {
-			DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-			Document doc = factory.newDocumentBuilder().newDocument();
+			Document doc = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
 			Element root = doc.createElement("project"); //$NON-NLS-1$
 			root.setAttribute("name", "build"); //$NON-NLS-1$ //$NON-NLS-2$
 			root.setAttribute("default", "plugin_export"); //$NON-NLS-1$ //$NON-NLS-2$
--- a/eclipse.pde.ui/ui/org.eclipse.pde.ui.templates/templates_3.1/extensibleEditor/java/ValidatorDocumentSetupParticipant.java	2024-03-19 10:01:54.563093498 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.ui.templates/templates_3.1/extensibleEditor/java/ValidatorDocumentSetupParticipant.java	2024-03-20 08:58:08.422601994 +0100
@@ -4,6 +4,7 @@
 
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
 
 import org.eclipse.core.filebuffers.IDocumentSetupParticipant;
 import org.eclipse.core.filebuffers.IDocumentSetupParticipantExtension;
@@ -40,7 +41,14 @@
 				this.marker = null;
 			}
 			try (StringReader reader = new StringReader(event.getDocument().get());) {
-				DocumentBuilder documentBuilder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+				DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+				// completely disable DOCTYPE declaration:
+				try {
+					factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+				} catch (ParserConfigurationException e) {
+					throw new RuntimeException(e.getMessage(), e);
+				}
+				DocumentBuilder documentBuilder = factory.newDocumentBuilder();
 				documentBuilder.parse(new InputSource(reader));
 			} catch (Exception ex) {
 				try {
--- a/eclipse.pde.ui/ui/org.eclipse.pde.ui.tests/src/org/eclipse/pde/core/tests/internal/feature/FeatureDataTestCase.java	2024-03-19 10:01:54.469759964 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.ui.tests/src/org/eclipse/pde/core/tests/internal/feature/FeatureDataTestCase.java	2024-03-20 09:09:09.847199348 +0100
@@ -23,6 +23,7 @@
 import org.eclipse.pde.internal.core.feature.FeatureData;
 import org.eclipse.pde.internal.core.feature.WorkspaceFeatureModel;
 import org.eclipse.pde.internal.core.ifeature.IFeatureModel;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.junit.Test;
 import org.w3c.dom.*;
 import org.xml.sax.InputSource;
@@ -85,8 +86,7 @@
 	}
 
 	public static FeatureData fromXml(String xml) throws Exception {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-		DocumentBuilder builder = factory.newDocumentBuilder();
+		DocumentBuilder builder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 		InputSource is = new InputSource(new StringReader(xml));
 		Document doc = builder.parse(is);
 
--- a/eclipse.pde.ui/ui/org.eclipse.pde.ui.tests/src/org/eclipse/pde/core/tests/internal/PDEXmlProcessorFactoryTest.java	1970-01-01 01:00:00.000000000 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.ui.tests/src/org/eclipse/pde/core/tests/internal/PDEXmlProcessorFactoryTest.java	2024-03-20 08:58:08.422601994 +0100
@@ -0,0 +1,372 @@
+/*******************************************************************************
+ *  Copyright (c) 2023 Joerg Kubitz and others.
+ *
+ *  This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License 2.0
+ *  which accompanies this distribution, and is available at
+ *  https://www.eclipse.org/legal/epl-2.0/
+ *
+ *  SPDX-License-Identifier: EPL-2.0
+ *******************************************************************************/
+package org.eclipse.pde.core.tests.internal;
+
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.not;
+import static org.hamcrest.CoreMatchers.startsWith;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+import java.io.BufferedReader;
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.OutputStream;
+import java.net.ServerSocket;
+import java.net.Socket;
+import java.net.SocketException;
+import java.net.URI;
+import java.net.URL;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.concurrent.ConcurrentLinkedQueue;
+import java.util.function.IntFunction;
+
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.SAXParser;
+import javax.xml.transform.Result;
+import javax.xml.transform.Source;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerException;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.stream.StreamResult;
+import javax.xml.transform.stream.StreamSource;
+
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.rules.TemporaryFolder;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXParseException;
+import org.xml.sax.helpers.DefaultHandler;
+
+public class PDEXmlProcessorFactoryTest {
+
+	@Rule
+	public TemporaryFolder tempFolder = new TemporaryFolder();
+
+	@Test
+	public void testParseXmlWithExternalEntity() throws Exception {
+		SAXParser parser = PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
+		try {
+			testParseXmlWithExternalEntity(parser, this::createMalciousXml);
+			assertTrue("SAXParseException expected", false);
+		} catch (SAXParseException e) {
+			String message = e.getMessage();
+			assertTrue(message, message.contains("DOCTYPE"));
+			assertTrue(message, message.contains("http://apache.org/xml/features/disallow-doctype-decl"));
+		}
+	}
+
+	@Test
+	public void testParseXmlWithoutExternalEntity() throws Exception {
+		SAXParser parser = PDEXmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE();
+		testParseXmlWithExternalEntity(parser, this::createNormalXml);
+	}
+
+	@Test
+	public void testParseXmlWithIgnoredExternalEntity() throws Exception {
+		SAXParser parser = PDEXmlProcessorFactory.createSAXParserIgnoringDOCTYPE();
+		testParseXmlWithExternalEntity(parser, this::createMalciousXml);
+	}
+
+	@Test
+	public void testParseXmlWithoutIgnoredExternalEntity() throws Exception {
+		SAXParser parser = PDEXmlProcessorFactory.createSAXParserIgnoringDOCTYPE();
+		testParseXmlWithExternalEntity(parser, this::createNormalXml);
+	}
+
+	public void testParseXmlWithExternalEntity(SAXParser parser, IntFunction<InputStream> xmlSupplier)
+			throws Exception {
+		try (Server httpServerThread = new Server()) {
+			List<String> elements = new ArrayList<>();
+			DefaultHandler handler = new DefaultHandler() {
+				@Override
+				public void startElement(String uri, String localName, String qName, org.xml.sax.Attributes attributes)
+						throws org.xml.sax.SAXException {
+					elements.add(qName);
+				}
+
+				@Override
+				public void characters(char ch[], int start, int length) throws SAXException {
+					String content = new String(ch, start, length);
+					assertFalse("Secret was injected into xml: " + content, content.contains("secret")); // var4
+				}
+
+				@Override
+				public InputSource resolveEntity(String publicId, String systemId) throws IOException, SAXException {
+					// implementation that would do any remote call:
+					try {
+						return new InputSource(URI.create(systemId).toURL().openStream());
+					} catch (IOException exception) {
+						throw new SAXException(exception);
+					}
+					// Also the default impl injects files:
+					// return null;
+
+					// Does also prevent access to external files:
+					// return new InputSource(new StringReader(""));
+				}
+
+			};
+			try (InputStream xmlStream = xmlSupplier.apply(httpServerThread.getLocalPort())) {
+				parser.parse(xmlStream, handler);
+			}
+			assertEquals(List.of("Body"), elements);
+		}
+	}
+
+	@Test
+	public void testDocumentBuilderXmlWithExternalEntity() throws Exception {
+		DocumentBuilder documentBuilder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
+		try {
+			testParseXmlWithExternalEntity(documentBuilder, this::createMalciousXml);
+			assertTrue("SAXParseException expected", false);
+		} catch (SAXParseException e) {
+			String message = e.getMessage();
+			assertTrue(message, message.contains("DOCTYPE"));
+		}
+	}
+
+	@Test
+	public void testDocumentBuilderFactoryWithoutExternalEntity() throws Exception {
+		DocumentBuilderFactory documentBuilderFactory = PDEXmlProcessorFactory
+				.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
+		testParseXmlWithExternalEntity(documentBuilderFactory.newDocumentBuilder(), this::createNormalXml);
+	}
+
+	@Test
+	public void testDocumentBuilderWithoutExternalEntity() throws Exception {
+		DocumentBuilder documentBuilder = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
+		testParseXmlWithExternalEntity(documentBuilder, this::createNormalXml);
+	}
+
+	@Test
+	public void testDocumentBuilderFactoryIgnoringDoctypeNormal() throws Exception {
+		DocumentBuilderFactory documentBuilderFactory = PDEXmlProcessorFactory
+				.createDocumentBuilderFactoryIgnoringDOCTYPE();
+		testParseXmlWithExternalEntity(documentBuilderFactory.newDocumentBuilder(), this::createNormalXml);
+	}
+
+	@Test
+	public void testDocumentBuilderFactoryIgnoringDoctypeMalcious() throws Exception {
+		DocumentBuilderFactory documentBuilderFactory = PDEXmlProcessorFactory
+				.createDocumentBuilderFactoryIgnoringDOCTYPE();
+		testParseXmlWithExternalEntity(documentBuilderFactory.newDocumentBuilder(), this::createMalciousXml);
+	}
+
+	@Test
+	public void testDocumentBuilderIgnoringDoctypeNormal() throws Exception {
+		testParseXmlWithExternalEntity(PDEXmlProcessorFactory.createDocumentBuilderIgnoringDOCTYPE(),
+				this::createNormalXml);
+	}
+
+	@Test
+	public void testDocumentBuilderIgnoringDoctypeMalcious() throws Exception {
+		testParseXmlWithExternalEntity(PDEXmlProcessorFactory.createDocumentBuilderIgnoringDOCTYPE(),
+				this::createMalciousXml);
+	}
+
+	public void testParseXmlWithExternalEntity(DocumentBuilder builder, IntFunction<InputStream> xmlSupplier)
+			throws Exception {
+		try (Server httpServerThread = new Server()) {
+			Document document;
+
+			try (InputStream xmlStream = xmlSupplier.apply(httpServerThread.getLocalPort())) {
+				document = builder.parse(xmlStream);
+			}
+			Element root = document.getDocumentElement();
+
+			assertEquals("Body", root.getTagName());
+			if (root.getChildNodes().getLength() > 0) {
+				String value = root.getChildNodes().item(0).getNodeValue();
+				assertFalse("Parser injected secret: " + value, value.contains("secret"));
+			}
+		}
+	}
+
+	@Test
+	public void testTransformXmlWithExternalEntity() throws Exception {
+		TransformerFactory transformerFactory = PDEXmlProcessorFactory
+				.createTransformerFactoryWithErrorOnDOCTYPE();
+		try {
+			testParseXmlWithExternalEntity(transformerFactory, this::createMalciousXml);
+			assertTrue("TransformerException expected", false);
+		} catch (TransformerException e) {
+			String message = e.getMessage();
+			assertTrue(message, message.contains("DTD"));
+		}
+	}
+
+	@Test
+	public void testTransformXmlWithoutExternalEntity() throws Exception {
+		TransformerFactory transformerFactory = PDEXmlProcessorFactory
+				.createTransformerFactoryWithErrorOnDOCTYPE();
+		testParseXmlWithExternalEntity(transformerFactory, this::createNormalXml);
+	}
+
+	public void testParseXmlWithExternalEntity(TransformerFactory transformerFactory,
+			IntFunction<InputStream> xmlSupplier) throws Exception {
+		try (Server httpServerThread = new Server()) {
+			String formatted;
+
+			try (InputStream xmlStream = xmlSupplier.apply(httpServerThread.getLocalPort())) {
+				Transformer xformer = transformerFactory.newTransformer();
+				Source source = new StreamSource(xmlStream);
+				try (ByteArrayOutputStream outputStream = new ByteArrayOutputStream()) {
+					Result result = new StreamResult(outputStream);
+					xformer.transform(source, result);
+					formatted = outputStream.toString(StandardCharsets.UTF_8);
+				}
+			}
+			assertTrue(formatted, formatted.contains("<Body>"));
+			assertFalse("Formatter injected secret: " + formatted, formatted.contains("secret"));
+		}
+	}
+
+	private InputStream createMalciousXml(int localPort) {
+		try {
+			Path tempSecret = tempFolder.newFile("test.txt").toPath();
+			Files.writeString(tempSecret, "secret");
+			Path tempDtd = tempFolder.newFile("test.dtd").toPath();
+			URL secretURL = tempSecret.toUri().toURL();
+			String dtdContent = "<!ENTITY % var1 SYSTEM \"" + secretURL + "\">\n" //
+					+ "<!ENTITY var4 SYSTEM \"" + secretURL + "\">\n" //
+					+ "<!ENTITY % var2 \"<!ENTITY var3 SYSTEM 'http://localhost:" + localPort + "/?%var1;'>\">\n" //
+					+ "%var2;\n";
+			Files.writeString(tempDtd, dtdContent);
+			URL dtdURL = tempDtd.toUri().toURL();
+			String xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" //
+					+ "<!DOCTYPE var1 SYSTEM \"" + dtdURL + "\">\n" //
+					+ "<Body>&var3;&var4;</Body>";
+			return new ByteArrayInputStream(xml.getBytes(StandardCharsets.UTF_8));
+		} catch (IOException e) {
+			throw new RuntimeException(e);
+		}
+	}
+
+	private InputStream createNormalXml(int localPort) {
+		String xml = """
+				<?xml version="1.0" encoding="UTF-8"?>
+				<Body>hello</Body>""";
+		return new ByteArrayInputStream(xml.getBytes(StandardCharsets.UTF_8));
+	}
+
+	public static final class Server implements AutoCloseable {
+		private final ServerSocket serverSocket;
+		private final Thread httpServerThread;
+		private final Collection<Throwable> exceptionsInOtherThreads = new ConcurrentLinkedQueue<>();
+
+		private Server() throws IOException {
+			serverSocket = new ServerSocket(0);
+			httpServerThread = new Thread("httpServerThread") {
+				@Override
+				public void run() {
+					try (Socket socket = serverSocket.accept()) {
+						try (BufferedReader in = new BufferedReader(new InputStreamReader(socket.getInputStream()))) {
+							String firstLine = in.readLine();
+							System.out.println(socket.getInetAddress() + ": " + firstLine);
+							try (OutputStream outputStream = socket.getOutputStream()) {
+								outputStream.write("HTTP/1.1 200 OK\r\n".getBytes(StandardCharsets.UTF_8));
+							}
+							assertThat(firstLine, startsWith("GET"));
+							assertThat(firstLine, not(containsString("secret")));
+							fail("Server was contacted");
+						}
+					} catch (SocketException closed) {
+						// expected
+					} catch (Throwable e) {
+						exceptionsInOtherThreads.add(e);
+					}
+				}
+			};
+
+			httpServerThread.start();
+		}
+
+		@Override
+		public void close() throws Exception {
+			serverSocket.close(); // -> SocketException in httpServerThread
+			httpServerThread.join(5000);
+			assertFalse(httpServerThread.isAlive());
+			for (Throwable e : exceptionsInOtherThreads) {
+				throw new AssertionError(e.getMessage(), e);
+			}
+		}
+
+		public int getLocalPort() {
+			return serverSocket.getLocalPort();
+		}
+
+		/** Example Server that will log and quit when contacted **/
+		public static void main(String[] args) throws Exception {
+			@SuppressWarnings("resource")
+			Server server = new Server();
+			System.out.println("Server startet on port: " + server.getLocalPort());
+			server.httpServerThread.join();
+			server.close();
+		}
+	}
+
+	static volatile Object sink;
+
+	/**
+	 * Simple performance demonstration: It's slow to create Factory but 100
+	 * times faster to create a Parser.
+	 **/
+	public static void main(String[] args) throws Exception {
+		for (int i = 1; i < 1000; i++) {
+			long n0 = System.nanoTime();
+			sink = PDEXmlProcessorFactory.createSAXParserIgnoringDOCTYPE();
+			long n1 = System.nanoTime();
+			System.out.println("createSAXParserIgnoringDOCTYPE run " + i + ": " + (n1 - n0) + "ns");
+			// ~ run 999: 60000ns =0,06ms
+
+			n0 = System.nanoTime();
+			sink = PDEXmlProcessorFactory.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
+			n1 = System.nanoTime();
+			System.out.println("createDocumentBuilderFactoryWithErrorOnDOCTYPE run " + i + ": " + (n1 - n0) + "ns");
+			// ~ run 999: 5000000ns =5ms
+
+			n0 = System.nanoTime();
+			sink = PDEXmlProcessorFactory.createDocumentBuilderIgnoringDOCTYPE();
+			n1 = System.nanoTime();
+			System.out.println("createDocumentBuilderIgnoringDOCTYPE run " + i + ": " + (n1 - n0) + "ns");
+			// ~ run 999: 40000ns =0,04ms
+
+			n0 = System.nanoTime();
+			sink = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
+			n1 = System.nanoTime();
+			System.out.println("createDocumentBuilderWithErrorOnDOCTYPE run " + i + ": " + (n1 - n0) + "ns");
+			// ~ run 999: 30000ns =0,03ms
+
+			n0 = System.nanoTime();
+			sink = PDEXmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE();
+			n1 = System.nanoTime();
+			System.out.println("createTransformerFactoryWithErrorOnDOCTYPE run " + i + ": " + (n1 - n0) + "ns");
+			// ~ run 999: 5000000ns =5ms
+		}
+	}
+}
\ No newline at end of file
--- a/eclipse.pde.ui/ui/org.eclipse.pde.ui.tests/src/org/eclipse/pde/ui/tests/target/IUBundleContainerTests.java	2024-03-19 10:01:54.469759964 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.ui.tests/src/org/eclipse/pde/ui/tests/target/IUBundleContainerTests.java	2024-03-20 09:11:38.940817604 +0100
@@ -36,6 +36,7 @@
 import org.eclipse.pde.core.plugin.IPluginModelBase;
 import org.eclipse.pde.core.target.*;
 import org.eclipse.pde.internal.core.PDECore;
+import org.eclipse.pde.internal.core.util.PDEXmlProcessorFactory;
 import org.eclipse.pde.internal.core.target.*;
 import org.eclipse.pde.ui.tests.PDETestsPlugin;
 import org.junit.Test;
@@ -540,7 +541,7 @@
 		ByteArrayOutputStream out = new ByteArrayOutputStream();
 		TargetDefinitionPersistenceHelper.persistXML(td, out);
 		String xml = new String(out.toByteArray());
-		DocumentBuilder parser = DocumentBuilderFactory.newInstance().newDocumentBuilder();
+		DocumentBuilder parser = PDEXmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 		parser.setErrorHandler(new DefaultHandler());
 		Document doc = parser.parse(new InputSource(new ByteArrayInputStream(xml.getBytes(StandardCharsets.UTF_8))));
 
--- a/eclipse.pde.ui/ui/org.eclipse.pde.ui.tests/src/org/eclipse/pde/ui/tests/util/DOMParserWrapper.java	2024-03-19 10:01:54.469759964 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.ui.tests/src/org/eclipse/pde/ui/tests/util/DOMParserWrapper.java	1970-01-01 01:00:00.000000000 +0100
@@ -1,58 +0,0 @@
-/*******************************************************************************
- * Copyright (c) 2009, 2018 IBM Corporation and others.
- *
- * This program and the accompanying materials
- * are made available under the terms of the Eclipse Public License 2.0
- * which accompanies this distribution, and is available at
- * https://www.eclipse.org/legal/epl-2.0/
- *
- * SPDX-License-Identifier: EPL-2.0
- *
- * Contributors:
- *     IBM Corporation - initial API and implementation
- *******************************************************************************/
-
-package org.eclipse.pde.ui.tests.util;
-
-import java.io.File;
-import java.io.IOException;
-import javax.xml.parsers.*;
-import org.eclipse.pde.internal.core.util.PDEXMLHelper;
-import org.w3c.dom.Document;
-import org.xml.sax.SAXException;
-
-public class DOMParserWrapper implements AutoCloseable {
-
-	protected DocumentBuilder fParser;
-	protected boolean isdisposed;
-
-	public DOMParserWrapper() throws ParserConfigurationException, FactoryConfigurationError {
-		fParser = PDEXMLHelper.Instance().getDefaultDOMParser();
-		isdisposed = false;
-	}
-
-	// Explicit disposal
-	public void dispose() {
-		if (isdisposed == false) {
-			PDEXMLHelper.Instance().recycleDOMParser(fParser);
-			isdisposed = true;
-		}
-	}
-
-	public Document parse(File f) throws SAXException, IOException {
-		return fParser.parse(f);
-	}
-
-	public Document newDocument() {
-		return fParser.newDocument();
-	}
-
-	// NOTE:  If other parser method calls are required, the corresponding
-	// wrapper method needs to be added here
-
-	@Override
-	public void close() {
-		dispose();
-	}
-
-}
--- a/eclipse.pde.ui/ui/org.eclipse.pde.ui.tests/src/org/eclipse/pde/ui/tests/util/xml/ParserWrapperTestCase.java	2024-03-19 10:01:54.469759964 +0100
+++ b/eclipse.pde.ui/ui/org.eclipse.pde.ui.tests/src/org/eclipse/pde/ui/tests/util/xml/ParserWrapperTestCase.java	2024-03-20 09:13:14.884334289 +0100
@@ -25,7 +25,6 @@
 import org.eclipse.pde.internal.core.XMLDefaultHandler;
 import org.eclipse.pde.internal.core.util.SAXParserWrapper;
 import org.eclipse.pde.ui.tests.PDETestsPlugin;
-import org.eclipse.pde.ui.tests.util.DOMParserWrapper;
 import org.junit.Before;
 import org.junit.Test;
 import org.osgi.framework.Bundle;
@@ -73,23 +72,6 @@
 
 	}
 
-	@Test
-	public void testDOMParserWrapperConcurrency() throws Exception {
-
-		ParserThread[] threads = new ParserThread[FTHREADCOUNT];
-
-		for (int x = 0; x < FTHREADCOUNT; x++) {
-			threads[x] = new ParserThread(FDOM, fXMLFile);
-			threads[x].start();
-		}
-
-		for (int x = 0; x < FTHREADCOUNT; x++) {
-			threads[x].join();
-			assertFalse(threads[x].getError());
-		}
-
-	}
-
 	public class ParserThread extends Thread {
 
 		protected final int FITERATIONS = 100;
@@ -108,10 +90,7 @@
 
 			if (fParserType == ParserWrapperTestCase.FSAX) {
 				runSAX();
-			} else {
-				runDOM();
 			}
-
 		}
 
 		public void runSAX() {
@@ -136,23 +115,6 @@
 
 		}
 
-		public void runDOM() {
-
-			for (int x = 0; x < FITERATIONS; x++) {
-
-				try (DOMParserWrapper parser = new DOMParserWrapper()) {
-					parser.parse(fParserXMLFile);
-				} catch (ParserConfigurationException | SAXException | FactoryConfigurationError | IOException e) {
-					e.printStackTrace();
-					fError = true;
-				}
-				// If an error was encountered abort the thread
-				// Any type of exception experienced is bad
-				if (fError)
-					return;
-
-			}
-		}
 
 		public boolean getError() {
 			return fError;
--- a/eclipse.platform/update/org.eclipse.update.configurator/META-INF/MANIFEST.MF	2024-03-19 10:01:56.373097399 +0100
+++ b/eclipse.platform/update/org.eclipse.update.configurator/META-INF/MANIFEST.MF	2024-03-20 12:27:53.028756091 +0100
@@ -11,7 +11,8 @@
  org.eclipse.update.internal.configurator.branding;x-friends:="org.eclipse.update.core"
 Eclipse-LazyStart: true
 Require-Bundle: org.eclipse.equinox.common;bundle-version="[3.2.0,4.0.0)",
- org.eclipse.osgi;bundle-version="[3.2.0,4.0.0)"
+ org.eclipse.osgi;bundle-version="[3.2.0,4.0.0)",
+ org.eclipse.core.runtime;bundle-version="[3.11.0,4.0.0)"
 Bundle-RequiredExecutionEnvironment: JavaSE-1.8
 Import-Package: javax.xml.parsers,
  org.w3c.dom,
--- a/eclipse.platform/update/org.eclipse.update.configurator/src/org/eclipse/update/internal/configurator/ConfigurationParser.java	2024-03-19 10:01:56.373097399 +0100
+++ b/eclipse.platform/update/org.eclipse.update.configurator/src/org/eclipse/update/internal/configurator/ConfigurationParser.java	2024-03-20 12:22:25.604833946 +0100
@@ -25,7 +25,6 @@
 
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.eclipse.core.runtime.CoreException;
 import org.eclipse.core.runtime.URIUtil;
@@ -43,8 +42,6 @@
 	
 	private static final String URL_PROPERTY = "org.eclipse.update.resolution_url"; //$NON-NLS-1$
 	private static final String EMPTY_STRING = ""; //$NON-NLS-1$
-	private final static SAXParserFactory parserFactory =
-		SAXParserFactory.newInstance();
 	private SAXParser parser;
 	
 	private URL currentSiteURL;
@@ -59,8 +56,7 @@
 	public ConfigurationParser() throws InvocationTargetException {
 
 		try {
-			parserFactory.setNamespaceAware(true);
-			this.parser = parserFactory.newSAXParser();
+			this.parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE(true);
 		} catch (ParserConfigurationException e) {
 			Utils.log(Utils.newStatus("ConfigurationParser", e)); //$NON-NLS-1$
 			throw new InvocationTargetException(e);
--- a/eclipse.platform/update/org.eclipse.update.configurator/src/org/eclipse/update/internal/configurator/FeatureParser.java	2024-03-19 10:01:56.373097399 +0100
+++ b/eclipse.platform/update/org.eclipse.update.configurator/src/org/eclipse/update/internal/configurator/FeatureParser.java	2024-03-20 12:22:44.744868356 +0100
@@ -35,17 +35,13 @@
 	private FeatureEntry feature;
 	private URL url;
 
-	private final static SAXParserFactory parserFactory =
-		SAXParserFactory.newInstance();
-
 	/**
 	 * Constructs a feature parser.
 	 */
 	public FeatureParser() {
 		super();
 		try {
-			parserFactory.setNamespaceAware(true);
-			this.parser = parserFactory.newSAXParser();
+			this.parser = org.eclipse.core.internal.runtime.XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE(true);
 		} catch (ParserConfigurationException e) {
 			System.out.println(e);
 		} catch (SAXException e) {
--- a/eclipse.platform.runtime/bundles/org.eclipse.core.runtime/src/org/eclipse/core/internal/runtime/XmlProcessorFactory.java	1970-01-01 01:00:00.000000000 +0100
+++ b/eclipse.platform.runtime/bundles/org.eclipse.core.runtime/src/org/eclipse/core/internal/runtime/XmlProcessorFactory.java	2024-03-20 12:07:18.269833676 +0100
@@ -0,0 +1,273 @@
+/*******************************************************************************
+ *  Copyright (c) 2023 Joerg Kubitz and others.
+ *
+ *  This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License 2.0
+ *  which accompanies this distribution, and is available at
+ *  https://www.eclipse.org/legal/epl-2.0/
+ *
+ *  SPDX-License-Identifier: EPL-2.0
+ *******************************************************************************/
+package org.eclipse.core.internal.runtime;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.TransformerFactory;
+import org.w3c.dom.Document;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+
+/**
+ * XML processing which prohibits external entities.
+ *
+ * @see <a href="https://rules.sonarsource.com/java/RSPEC-2755/">RSPEC-2755</a>
+ */
+public class XmlProcessorFactory {
+	private XmlProcessorFactory() {
+		// static Utility only
+	}
+
+	// using these factories is synchronized with creating & configuring them
+	// potentially concurrently in another thread:
+	private static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE = createDocumentBuilderFactoryWithErrorOnDOCTYPE();
+	private static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY_IGNORING_DOCTYPE = createDocumentBuilderFactoryIgnoringDOCTYPE();
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE = createSAXFactoryWithErrorOnDOCTYPE(false);
+	private static final SAXParserFactory SAX_FACTORY_ERROR_ON_DOCTYPE_NS = createSAXFactoryWithErrorOnDOCTYPE(true);
+	private static final SAXParserFactory SAX_FACTORY_IGNORING_DOCTYPE = createSAXFactoryIgnoringDOCTYPE();
+	private static final SAXParserFactory SAX_FACTORY_PURE = createSAXFactory(false);
+	private static final SAXParserFactory SAX_FACTORY_PURE_NS = createSAXFactory(true);
+
+	/**
+	 * Creates TransformerFactory which throws TransformerException when detecting
+	 * external entities.
+	 *
+	 * @return javax.xml.transform.TransformerFactory
+	 */
+	public static TransformerFactory createTransformerFactoryWithErrorOnDOCTYPE() {
+		TransformerFactory factory = TransformerFactory.newInstance();
+		// prohibit the use of all protocols by external entities:
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, ""); //$NON-NLS-1$
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when detecting
+	 * external entities. It's magnitudes faster to call
+	 * {@link #createDocumentBuilderWithErrorOnDOCTYPE()}.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static synchronized DocumentBuilderFactory createDocumentBuilderFactoryWithErrorOnDOCTYPE() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		// completely disable DOCTYPE declaration:
+		try {
+			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (ParserConfigurationException e) {
+			throw new RuntimeException(e.getMessage(), e);
+		}
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which ignores external entities. It's
+	 * magnitudes faster to call {@link #createDocumentBuilderIgnoringDOCTYPE()}.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static synchronized DocumentBuilderFactory createDocumentBuilderFactoryIgnoringDOCTYPE() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		try {
+			// completely disable external entities declarations:
+			factory.setFeature("http://xml.org/sax/features/external-general-entities", false); //$NON-NLS-1$
+			factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); //$NON-NLS-1$
+		} catch (ParserConfigurationException e) {
+			throw new RuntimeException(e.getMessage(), e);
+		}
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilder which throws SAXParseException when detecting
+	 * external entities. The builder is not thread safe.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilder
+	 * @throws ParserConfigurationException
+	 */
+	public static synchronized DocumentBuilder createDocumentBuilderWithErrorOnDOCTYPE()
+			throws ParserConfigurationException {
+		return DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE.newDocumentBuilder();
+	}
+
+	/**
+	 * Creates DocumentBuilder which ignores external entities. The builder is not
+	 * thread safe.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilder
+	 * @throws ParserConfigurationException
+	 */
+	public static synchronized DocumentBuilder createDocumentBuilderIgnoringDOCTYPE()
+			throws ParserConfigurationException {
+		return DOCUMENT_BUILDER_FACTORY_IGNORING_DOCTYPE.newDocumentBuilder();
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when detecting
+	 * external entities.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE() {
+		return createSAXFactoryWithErrorOnDOCTYPE(false);
+	}
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when detecting
+	 * external entities.
+	 *
+	 * @param awareness true if the parser produced by this code will provide
+	 *                  support for XML namespaces; false otherwise.
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static synchronized SAXParserFactory createSAXFactoryWithErrorOnDOCTYPE(boolean awareness) {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		if (awareness) {
+			f.setNamespaceAware(true);
+		}
+		try {
+			// force org.xml.sax.SAXParseException for any DOCTYPE:
+			f.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	private static synchronized SAXParserFactory createSAXFactoryIgnoringDOCTYPE() {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		try {
+			// ignore DOCTYPE:
+			f.setFeature("http://xml.org/sax/features/external-general-entities", false); //$NON-NLS-1$
+			f.setFeature("http://xml.org/sax/features/external-parameter-entities", false); //$NON-NLS-1$
+			f.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); //$NON-NLS-1$
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+		return f;
+	}
+
+	/**
+	 * Creates SAXParser which throws SAXParseException when detecting external
+	 * entities.
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+
+	public static SAXParser createSAXParserWithErrorOnDOCTYPE() throws ParserConfigurationException, SAXException {
+		return createSAXParserWithErrorOnDOCTYPE(false);
+	}
+
+	/**
+	 * Creates SAXParser which throws SAXParseException when detecting external
+	 * entities.
+	 *
+	 * @param namespaceAware parameter for SAXParserFactory
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+	public static synchronized SAXParser createSAXParserWithErrorOnDOCTYPE(boolean namespaceAware)
+			throws ParserConfigurationException, SAXException {
+		if (namespaceAware) {
+			return SAX_FACTORY_ERROR_ON_DOCTYPE_NS.newSAXParser();
+		}
+		return SAX_FACTORY_ERROR_ON_DOCTYPE.newSAXParser();
+	}
+
+	/**
+	 * Creates SAXParser which does not throw Exception when detecting external
+	 * entities but ignores them.
+	 *
+	 * @return javax.xml.parsers.SAXParser
+	 */
+	public static synchronized SAXParser createSAXParserIgnoringDOCTYPE()
+			throws ParserConfigurationException, SAXException {
+		SAXParser parser = SAX_FACTORY_IGNORING_DOCTYPE.newSAXParser();
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); //$NON-NLS-1$
+		return parser;
+	}
+
+	private static synchronized SAXParserFactory createSAXFactory(boolean awareness) {
+		SAXParserFactory f = SAXParserFactory.newInstance();
+		if (awareness) {
+			f.setNamespaceAware(true);
+		}
+		return f;
+	}
+
+	public static synchronized SAXParser createSAXParserNoExternal(boolean namespaceAware)
+			throws ParserConfigurationException, SAXException {
+
+		SAXParser parser = namespaceAware ? SAX_FACTORY_PURE_NS.newSAXParser() : SAX_FACTORY_PURE.newSAXParser();
+		// prohibit the use of all protocols by external entities:
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, ""); //$NON-NLS-1$
+		parser.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, ""); //$NON-NLS-1$
+		return parser;
+	}
+
+	public static synchronized SAXParser createSAXParserNoExternal() throws ParserConfigurationException, SAXException {
+		return createSAXParserNoExternal(false);
+	}
+
+	/**
+	 * Parse the content of the given input source as an XML document and return a
+	 * new DOM {@link Document} object.
+	 *
+	 * @see javax.xml.parsers.DocumentBuilder#parse(InputSource)
+	 */
+	public static Document parseWithErrorOnDOCTYPE(InputSource is)
+			throws SAXException, IOException, ParserConfigurationException {
+		return createDocumentBuilderWithErrorOnDOCTYPE().parse(is);
+	}
+
+	/**
+	 * Parse the content of the given input source as an XML document and return a
+	 * new DOM {@link Document} object.
+	 *
+	 * @see javax.xml.parsers.DocumentBuilder#parse(InputStream)
+	 */
+	public static Document parseWithErrorOnDOCTYPE(InputStream is)
+			throws SAXException, IOException, ParserConfigurationException {
+		return createDocumentBuilderWithErrorOnDOCTYPE().parse(is);
+	}
+
+	/**
+	 * Parse the content of the given input source as an XML document and return a
+	 * new DOM {@link Document} object.
+	 *
+	 * @see javax.xml.parsers.DocumentBuilder#parse(File)
+	 */
+	public static Document parseWithErrorOnDOCTYPE(File file)
+			throws SAXException, IOException, ParserConfigurationException {
+		return createDocumentBuilderWithErrorOnDOCTYPE().parse(file);
+	}
+
+	/**
+	 * Obtain a new instance of a DOM {@link Document} object to build a DOM tree
+	 * with.
+	 *
+	 * @return A new instance of a DOM Document object.
+	 * @see javax.xml.parsers.DocumentBuilder#newDocument()
+	 */
+	public static Document newDocumentWithErrorOnDOCTYPE() throws ParserConfigurationException {
+		return createDocumentBuilderWithErrorOnDOCTYPE().newDocument();
+	}
+
+}
\ No newline at end of file
--- "a/eclipse.platform.swt/bundles/org.eclipse.swt.tools/Mac Generation/org/eclipse/swt/tools/internal/MacGenerator.java"	2024-03-19 10:01:56.149763584 +0100
+++ "b/eclipse.platform.swt/bundles/org.eclipse.swt.tools/Mac Generation/org/eclipse/swt/tools/internal/MacGenerator.java"	2024-03-19 14:04:31.634036279 +0100
@@ -17,8 +17,6 @@
 import java.util.*;
 import java.util.Map.*;
 
-import javax.xml.parsers.*;
-
 import org.w3c.dom.*;
 import org.xml.sax.*;
 
@@ -950,7 +948,11 @@
 		InputStream is = null;
 		if (xmlPath.indexOf(File.separatorChar) == -1) is = getClass().getResourceAsStream(xmlPath);
 		if (is == null) is = new BufferedInputStream(new FileInputStream(xmlPath));
-		if (is != null) return DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new InputSource(is));
+		if (is != null) {
+			@SuppressWarnings("restriction")
+			Document d = org.eclipse.core.internal.runtime.XmlProcessorFactory.parseWithErrorOnDOCTYPE(new InputSource(is));
+			return d;
+		}
 	} catch (Exception e) {
 //		e.printStackTrace();
 	}
--- a/eclipse.platform.text/org.eclipse.text/.settings/org.eclipse.jdt.core.prefs	2024-03-19 10:01:56.493097657 +0100
+++ b/eclipse.platform.text/org.eclipse.text/.settings/org.eclipse.jdt.core.prefs	2024-03-19 11:39:19.100332806 +0100
@@ -1,4 +1,5 @@
 eclipse.preferences.version=1
+org.eclipse.jdt.core.builder.annotationPath.allLocations=disabled
 org.eclipse.jdt.core.builder.cleanOutputFolder=clean
 org.eclipse.jdt.core.builder.duplicateResourceTask=warning
 org.eclipse.jdt.core.builder.invalidClasspath=abort
@@ -21,8 +22,11 @@
 org.eclipse.jdt.core.compiler.annotation.inheritNullAnnotations=disabled
 org.eclipse.jdt.core.compiler.annotation.missingNonNullByDefaultAnnotation=ignore
 org.eclipse.jdt.core.compiler.annotation.nonnull=org.eclipse.jdt.annotation.NonNull
+org.eclipse.jdt.core.compiler.annotation.nonnull.secondary=
 org.eclipse.jdt.core.compiler.annotation.nonnullbydefault=org.eclipse.jdt.annotation.NonNullByDefault
+org.eclipse.jdt.core.compiler.annotation.nonnullbydefault.secondary=
 org.eclipse.jdt.core.compiler.annotation.nullable=org.eclipse.jdt.annotation.Nullable
+org.eclipse.jdt.core.compiler.annotation.nullable.secondary=
 org.eclipse.jdt.core.compiler.annotation.nullanalysis=disabled
 org.eclipse.jdt.core.compiler.codegen.inlineJsrBytecode=enabled
 org.eclipse.jdt.core.compiler.codegen.methodParameters=do not generate
@@ -34,6 +38,8 @@
 org.eclipse.jdt.core.compiler.debug.sourceFile=generate
 org.eclipse.jdt.core.compiler.doc.comment.support=enabled
 org.eclipse.jdt.core.compiler.maxProblemPerUnit=100
+org.eclipse.jdt.core.compiler.problem.APILeak=warning
+org.eclipse.jdt.core.compiler.problem.annotatedTypeArgumentToUnannotated=info
 org.eclipse.jdt.core.compiler.problem.annotationSuperInterface=warning
 org.eclipse.jdt.core.compiler.problem.assertIdentifier=error
 org.eclipse.jdt.core.compiler.problem.autoboxing=info
@@ -42,7 +48,7 @@
 org.eclipse.jdt.core.compiler.problem.deprecation=warning
 org.eclipse.jdt.core.compiler.problem.deprecationInDeprecatedCode=disabled
 org.eclipse.jdt.core.compiler.problem.deprecationWhenOverridingDeprecatedMethod=enabled
-org.eclipse.jdt.core.compiler.problem.discouragedReference=error
+org.eclipse.jdt.core.compiler.problem.discouragedReference=warning
 org.eclipse.jdt.core.compiler.problem.emptyStatement=warning
 org.eclipse.jdt.core.compiler.problem.enumIdentifier=error
 org.eclipse.jdt.core.compiler.problem.explicitlyClosedAutoCloseable=warning
@@ -84,12 +90,14 @@
 org.eclipse.jdt.core.compiler.problem.noImplicitStringConversion=error
 org.eclipse.jdt.core.compiler.problem.nonExternalizedStringLiteral=warning
 org.eclipse.jdt.core.compiler.problem.nonnullParameterAnnotationDropped=warning
+org.eclipse.jdt.core.compiler.problem.nonnullTypeVariableFromLegacyInvocation=warning
 org.eclipse.jdt.core.compiler.problem.nullAnnotationInferenceConflict=error
 org.eclipse.jdt.core.compiler.problem.nullReference=error
 org.eclipse.jdt.core.compiler.problem.nullSpecViolation=error
 org.eclipse.jdt.core.compiler.problem.nullUncheckedConversion=warning
 org.eclipse.jdt.core.compiler.problem.overridingPackageDefaultMethod=error
 org.eclipse.jdt.core.compiler.problem.parameterAssignment=ignore
+org.eclipse.jdt.core.compiler.problem.pessimisticNullAnalysisForFreeTypeVariables=warning
 org.eclipse.jdt.core.compiler.problem.possibleAccidentalBooleanAssignment=error
 org.eclipse.jdt.core.compiler.problem.potentialNullReference=info
 org.eclipse.jdt.core.compiler.problem.potentiallyUnclosedCloseable=info
@@ -104,17 +112,23 @@
 org.eclipse.jdt.core.compiler.problem.staticAccessReceiver=error
 org.eclipse.jdt.core.compiler.problem.suppressOptionalErrors=disabled
 org.eclipse.jdt.core.compiler.problem.suppressWarnings=enabled
+org.eclipse.jdt.core.compiler.problem.suppressWarningsNotFullyAnalysed=info
 org.eclipse.jdt.core.compiler.problem.syntacticNullAnalysisForFields=disabled
 org.eclipse.jdt.core.compiler.problem.syntheticAccessEmulation=ignore
+org.eclipse.jdt.core.compiler.problem.terminalDeprecation=warning
 org.eclipse.jdt.core.compiler.problem.typeParameterHiding=warning
 org.eclipse.jdt.core.compiler.problem.unavoidableGenericTypeProblems=enabled
 org.eclipse.jdt.core.compiler.problem.uncheckedTypeOperation=warning
 org.eclipse.jdt.core.compiler.problem.unclosedCloseable=warning
 org.eclipse.jdt.core.compiler.problem.undocumentedEmptyBlock=info
 org.eclipse.jdt.core.compiler.problem.unhandledWarningToken=warning
+org.eclipse.jdt.core.compiler.problem.unlikelyCollectionMethodArgumentType=warning
+org.eclipse.jdt.core.compiler.problem.unlikelyCollectionMethodArgumentTypeStrict=disabled
+org.eclipse.jdt.core.compiler.problem.unlikelyEqualsArgumentType=info
 org.eclipse.jdt.core.compiler.problem.unnecessaryElse=ignore
 org.eclipse.jdt.core.compiler.problem.unnecessaryTypeCheck=error
 org.eclipse.jdt.core.compiler.problem.unqualifiedFieldAccess=ignore
+org.eclipse.jdt.core.compiler.problem.unstableAutoModuleName=warning
 org.eclipse.jdt.core.compiler.problem.unusedDeclaredThrownException=warning
 org.eclipse.jdt.core.compiler.problem.unusedDeclaredThrownExceptionExemptExceptionAndThrowable=enabled
 org.eclipse.jdt.core.compiler.problem.unusedDeclaredThrownExceptionIncludeDocCommentReference=enabled
--- a/eclipse.platform.text/org.eclipse.text/src/org/eclipse/text/templates/TemplateReaderWriter.java	2024-03-19 10:01:56.489764316 +0100
+++ b/eclipse.platform.text/org.eclipse.text/src/org/eclipse/text/templates/TemplateReaderWriter.java	2024-03-19 11:39:19.100332806 +0100
@@ -27,12 +27,10 @@
 import java.util.Set;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.dom.DOMSource;
 import javax.xml.transform.stream.StreamResult;
 
@@ -157,8 +155,8 @@
 			Collection<TemplatePersistenceData> templates= new ArrayList<>();
 			Set<String> ids= new HashSet<>();
 
-			DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
-			DocumentBuilder parser= factory.newDocumentBuilder();
+			@SuppressWarnings("restriction")
+			DocumentBuilder parser= org.eclipse.core.internal.runtime.XmlProcessorFactory.createDocumentBuilderWithErrorOnDOCTYPE();
 			parser.setErrorHandler(new DefaultHandler());
 			Document document= parser.parse(source);
 
@@ -263,10 +261,8 @@
 	 */
 	private void save(TemplatePersistenceData[] templates, StreamResult result) throws IOException {
 		try {
-			DocumentBuilderFactory factory= DocumentBuilderFactory.newInstance();
-			DocumentBuilder builder= factory.newDocumentBuilder();
-			Document document= builder.newDocument();
-
+			@SuppressWarnings("restriction")
+			Document document= org.eclipse.core.internal.runtime.XmlProcessorFactory.newDocumentWithErrorOnDOCTYPE();
 			Node root= document.createElement(TEMPLATE_ROOT);
 			document.appendChild(root);
 
@@ -322,9 +318,8 @@
 					node.appendChild(pattern);
 				}
 			}
-
-
-			Transformer transformer=TransformerFactory.newInstance().newTransformer();
+			@SuppressWarnings("restriction")
+			Transformer transformer= org.eclipse.core.internal.runtime.XmlProcessorFactory.createTransformerFactoryWithErrorOnDOCTYPE().newTransformer();
 			transformer.setOutputProperty(OutputKeys.METHOD, "xml"); //$NON-NLS-1$
 			transformer.setOutputProperty(OutputKeys.ENCODING, StandardCharsets.UTF_8.name());
 			DOMSource source = new DOMSource(document);
--- a/eclipse.platform.ui/bundles/org.eclipse.jface/src/org/eclipse/jface/dialogs/DialogSettings.java	2024-03-19 10:01:54.889760869 +0100
+++ b/eclipse.platform.ui/bundles/org.eclipse.jface/src/org/eclipse/jface/dialogs/DialogSettings.java	2024-03-19 11:39:19.100332806 +0100
@@ -36,9 +36,9 @@
 import java.util.Map.Entry;
 
 import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
+import org.eclipse.jface.internal.XmlProcessorFactoryJFace;
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 import org.w3c.dom.Node;
@@ -260,8 +260,7 @@
 	public void load(Reader r) {
 		Document document = null;
 		try {
-			DocumentBuilder parser = DocumentBuilderFactory.newInstance()
-					.newDocumentBuilder();
+			DocumentBuilder parser = XmlProcessorFactoryJFace.createDocumentBuilderWithErrorOnDOCTYPE();
 			//		parser.setProcessNamespace(true);
 			document = parser.parse(new InputSource(r));
 
--- a/eclipse.platform.ui/bundles/org.eclipse.jface/src/org/eclipse/jface/internal/XmlProcessorFactoryJFace.java	1970-01-01 01:00:00.000000000 +0100
+++ b/eclipse.platform.ui/bundles/org.eclipse.jface/src/org/eclipse/jface/internal/XmlProcessorFactoryJFace.java	2024-03-19 11:39:19.100332806 +0100
@@ -0,0 +1,59 @@
+/*******************************************************************************
+ *  Copyright (c) 2023 Joerg Kubitz and others.
+ *
+ *  This program and the accompanying materials
+ *  are made available under the terms of the Eclipse Public License 2.0
+ *  which accompanies this distribution, and is available at
+ *  https://www.eclipse.org/legal/epl-2.0/
+ *
+ *  SPDX-License-Identifier: EPL-2.0
+ *******************************************************************************/
+package org.eclipse.jface.internal;
+
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+
+/**
+ * XML processing which prohibits external entities.
+ *
+ * @see <a href="https://rules.sonarsource.com/java/RSPEC-2755/">RSPEC-2755</a>
+ */
+/* A copy of org.eclipse.core.internal.runtime.XmlProcessorFactory for jface. */
+public class XmlProcessorFactoryJFace {
+	private XmlProcessorFactoryJFace() {
+		// static Utility only
+	}
+
+	private static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE = createDocumentBuilderFactoryWithErrorOnDOCTYPE();
+
+	/**
+	 * Creates DocumentBuilderFactory which throws SAXParseException when detecting
+	 * external entities. It's magnitudes faster to call
+	 * {@link #createDocumentBuilderWithErrorOnDOCTYPE()}.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilderFactory
+	 */
+	public static synchronized DocumentBuilderFactory createDocumentBuilderFactoryWithErrorOnDOCTYPE() {
+		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		// completely disable DOCTYPE declaration:
+		try {
+			factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); //$NON-NLS-1$
+		} catch (ParserConfigurationException e) {
+			throw new RuntimeException(e.getMessage(), e);
+		}
+		return factory;
+	}
+
+	/**
+	 * Creates DocumentBuilder which throws SAXParseException when detecting
+	 * external entities. The builder is not thread safe.
+	 *
+	 * @return javax.xml.parsers.DocumentBuilder
+	 * @throws ParserConfigurationException
+	 */
+	public static DocumentBuilder createDocumentBuilderWithErrorOnDOCTYPE() throws ParserConfigurationException {
+		return DOCUMENT_BUILDER_FACTORY_ERROR_ON_DOCTYPE.newDocumentBuilder();
+	}
+
+}
\ No newline at end of file
--- a/eclipse.platform.ui/bundles/org.eclipse.ui.forms/src/org/eclipse/ui/internal/forms/widgets/FormTextModel.java	2024-03-19 10:01:54.983094403 +0100
+++ b/eclipse.platform.ui/bundles/org.eclipse.ui.forms/src/org/eclipse/ui/internal/forms/widgets/FormTextModel.java	2024-03-19 11:39:19.100332806 +0100
@@ -56,8 +56,9 @@
 		}
 	}
 
-	private static final DocumentBuilderFactory documentBuilderFactory = DocumentBuilderFactory
-			.newInstance();
+	@SuppressWarnings("restriction")
+	private static final DocumentBuilderFactory DOCUMENT_BUILDER_FACTORY = org.eclipse.core.internal.runtime.XmlProcessorFactory
+			.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 
 	private boolean whitespaceNormalized = true;
 
@@ -132,13 +133,12 @@
 
 	public void parseInputStream(InputStream is, boolean expandURLs) {
 
-		documentBuilderFactory.setNamespaceAware(true);
-		documentBuilderFactory.setIgnoringComments(true);
+		DOCUMENT_BUILDER_FACTORY.setNamespaceAware(true);
+		DOCUMENT_BUILDER_FACTORY.setIgnoringComments(true);
 
 		reset();
 		try {
-			DocumentBuilder parser = documentBuilderFactory
-					.newDocumentBuilder();
+			DocumentBuilder parser = DOCUMENT_BUILDER_FACTORY.newDocumentBuilder();
 			parser.setErrorHandler(new ParseErrorHandler());
 			InputSource source = new InputSource(is);
 			Document doc = parser.parse(source);
--- a/eclipse.platform.ui/bundles/org.eclipse.ui.ide/src/org/eclipse/ui/internal/ide/dialogs/WelcomeEditor.java	2024-03-19 10:01:54.916427593 +0100
+++ b/eclipse.platform.ui/bundles/org.eclipse.ui.ide/src/org/eclipse/ui/internal/ide/dialogs/WelcomeEditor.java	2024-03-19 11:39:19.100332806 +0100
@@ -19,8 +19,6 @@
 import java.net.URL;
 import java.util.ArrayList;
 
-import javax.xml.parsers.ParserConfigurationException;
-
 import org.eclipse.core.resources.IMarker;
 import org.eclipse.core.runtime.IProgressMonitor;
 import org.eclipse.core.runtime.IStatus;
@@ -63,7 +61,6 @@
 import org.eclipse.ui.internal.ide.IDEWorkbenchPlugin;
 import org.eclipse.ui.internal.ide.IIDEHelpContextIds;
 import org.eclipse.ui.part.EditorPart;
-import org.xml.sax.SAXException;
 
 /**
  * A "fake" editor to show a welcome page
@@ -853,7 +850,7 @@
 	 *
 	 * @see IEditorPart
 	 */
-	public void gotoMarker(IMarker marker) {
+	public void gotoMarker(@SuppressWarnings({ "unused", "javadoc" }) IMarker marker) {
 		// do nothing
 	}
 
@@ -920,7 +917,7 @@
 	public void read(InputStream is) throws IOException {
 		try {
 			parser = new WelcomeParser();
-		} catch (ParserConfigurationException | SAXException e) {
+		} catch (Exception e) {
 			throw (IOException) (new IOException().initCause(e));
 		}
 		parser.parse(is);
--- a/eclipse.platform.ui/bundles/org.eclipse.ui.ide/src/org/eclipse/ui/internal/ide/dialogs/WelcomeParser.java	2024-03-19 10:01:54.916427593 +0100
+++ b/eclipse.platform.ui/bundles/org.eclipse.ui.ide/src/org/eclipse/ui/internal/ide/dialogs/WelcomeParser.java	2024-03-19 11:39:19.100332806 +0100
@@ -21,7 +21,6 @@
 import javax.xml.parsers.FactoryConfigurationError;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
 
 import org.eclipse.core.runtime.IStatus;
 import org.eclipse.core.runtime.Status;
@@ -333,14 +332,15 @@
 
 	/**
 	 * Creates a new welcome parser.
+	 *
+	 * @throws ParserConfigurationException
+	 * @throws SAXException
+	 * @throws FactoryConfigurationError
 	 */
-	public WelcomeParser() throws ParserConfigurationException, SAXException,
-			FactoryConfigurationError {
-		super();
-		SAXParserFactory factory = SAXParserFactory.newInstance();
-		factory.setFeature("http://xml.org/sax/features/namespaces", true); //$NON-NLS-1$
-		parser = factory.newSAXParser();
-
+	public WelcomeParser() throws ParserConfigurationException, SAXException, FactoryConfigurationError {
+		@SuppressWarnings("restriction")
+		SAXParser p = org.eclipse.core.internal.runtime.XmlProcessorFactory.createSAXParserWithErrorOnDOCTYPE(true);
+		parser = p;
 		parser.getXMLReader().setContentHandler(this);
 		parser.getXMLReader().setDTDHandler(this);
 		parser.getXMLReader().setEntityResolver(this);
--- "a/eclipse.platform.ui/bundles/org.eclipse.ui.workbench/Eclipse UI/org/eclipse/ui/XMLMemento.java"	2024-03-19 10:01:54.933094295 +0100
+++ "b/eclipse.platform.ui/bundles/org.eclipse.ui.workbench/Eclipse UI/org/eclipse/ui/XMLMemento.java"	2024-03-19 11:46:51.181307067 +0100
@@ -51,6 +51,8 @@
 
 	private Element element;
 
+	private static String FILE_STRING = "file"; //$NON-NLS-1$
+
 	/**
 	 * Creates a <code>Document</code> from the <code>Reader</code> and returns a
 	 * memento on the first <code>Element</code> for reading the document.
@@ -84,8 +86,9 @@
 		Exception exception = null;
 
 		try {
-			DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
-			DocumentBuilder parser = factory.newDocumentBuilder();
+			@SuppressWarnings("restriction")
+			DocumentBuilder parser = org.eclipse.core.internal.runtime.XmlProcessorFactory
+					.createDocumentBuilderWithErrorOnDOCTYPE();
 			InputSource source = new InputSource(reader);
 			if (baseDir != null) {
 				source.setSystemId(baseDir);
@@ -146,14 +149,13 @@
 	 *                      type
 	 */
 	public static XMLMemento createWriteRoot(String type) throws DOMException {
-		Document document;
 		try {
-			document = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument();
+			@SuppressWarnings("restriction")
+			Document document = org.eclipse.core.internal.runtime.XmlProcessorFactory.newDocumentWithErrorOnDOCTYPE();
 			Element element = document.createElement(type);
 			document.appendChild(element);
 			return new XMLMemento(document, element);
 		} catch (ParserConfigurationException e) {
-//            throw new Error(e);
 			throw new Error(e.getMessage());
 		}
 	}
--- a/eclipse.platform.ui/bundles/org.eclipse.urischeme/src/org/eclipse/urischeme/internal/registration/PlistFileWriter.java	2024-03-19 10:01:54.876427507 +0100
+++ b/eclipse.platform.ui/bundles/org.eclipse.urischeme/src/org/eclipse/urischeme/internal/registration/PlistFileWriter.java	2024-03-20 13:59:52.205700452 +0100
@@ -19,8 +19,6 @@
 import java.io.Reader;
 import java.io.Writer;
 
-import javax.xml.parsers.DocumentBuilder;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.TransformerException;
 import javax.xml.transform.TransformerFactory;
@@ -206,7 +204,10 @@
 	private void transformDocument(Writer writer) {
 		try {
 			DOMSource source = new DOMSource(this.document);
-			TransformerFactory.newInstance().newTransformer().transform(source, new StreamResult(writer));
+			@SuppressWarnings("restriction")
+			TransformerFactory f = org.eclipse.core.internal.runtime.XmlProcessorFactory
+			.createTransformerFactoryWithErrorOnDOCTYPE();
+			f.newTransformer().transform(source, new StreamResult(writer));
 		} catch (TransformerException e) {
 			throw new IllegalStateException(e);
 		} finally {
@@ -214,11 +215,11 @@
 		}
 	}
 
+	@SuppressWarnings("restriction")
 	private Document getDom(Reader reader) {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
 		try {
-			DocumentBuilder builder = factory.newDocumentBuilder();
-			return builder.parse(new InputSource(reader));
+			return org.eclipse.core.internal.runtime.XmlProcessorFactory
+					.parseWithErrorOnDOCTYPE(new InputSource(reader));
 		} catch (ParserConfigurationException | IOException | SAXException e) {
 			throw new IllegalArgumentException(e);
 		} finally {
--- a/eclipse.platform.ui/tests/org.eclipse.ui.tests.pluginchecks/src/org/eclipse/ui/tests/pluginchecks/PluginWalkerTest.java	2024-03-19 10:01:55.063094576 +0100
+++ b/eclipse.platform.ui/tests/org.eclipse.ui.tests.pluginchecks/src/org/eclipse/ui/tests/pluginchecks/PluginWalkerTest.java	2024-03-19 11:39:19.103666147 +0100
@@ -32,6 +32,7 @@
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 
+import org.eclipse.core.internal.runtime.XmlProcessorFactory;
 import org.eclipse.core.runtime.IConfigurationElement;
 import org.eclipse.core.runtime.IExtension;
 import org.eclipse.core.runtime.IExtensionPoint;
@@ -61,6 +62,7 @@
  * be accessed
  *
  */
+@SuppressWarnings("restriction")
 public class PluginWalkerTest {
 
 	private BundleContext bundleContext;
@@ -188,7 +190,7 @@
 	}
 
 	private static DocumentBuilder createDocumentBuilder() throws ParserConfigurationException {
-		DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+		DocumentBuilderFactory factory = XmlProcessorFactory.createDocumentBuilderFactoryWithErrorOnDOCTYPE();
 		factory.setNamespaceAware(true);
 		return factory.newDocumentBuilder();
 	}
--- a/eclipse.platform.ui.tools/bundles/org.eclipse.e4.tools.emf.ui/src/org/eclipse/e4/tools/emf/ui/internal/common/component/tabs/DocUtil.java	2024-03-19 10:01:56.529764403 +0100
+++ b/eclipse.platform.ui.tools/bundles/org.eclipse.e4.tools.emf.ui/src/org/eclipse/e4/tools/emf/ui/internal/common/component/tabs/DocUtil.java	2024-03-19 11:39:19.103666147 +0100
@@ -14,8 +14,8 @@
 
 package org.eclipse.e4.tools.emf.ui.internal.common.component.tabs;
 
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
+
 import org.w3c.dom.Document;
 import org.w3c.dom.Element;
 
@@ -25,6 +25,7 @@
  * @author Steven Spungin
  *
  */
+@SuppressWarnings("restriction")
 public class DocUtil {
 
 	public static Element createChild(Element parent, String name) {
@@ -34,7 +35,7 @@
 	}
 
 	public static Document createDocument(String name) throws ParserConfigurationException {
-		Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument();
+		Document doc = org.eclipse.core.internal.runtime.XmlProcessorFactory.newDocumentWithErrorOnDOCTYPE();
 		doc.appendChild(doc.createElement(name));
 		return doc;
 	}
--- a/eclipse.platform.ui.tools/bundles/org.eclipse.e4.tools.emf.ui/src/org/eclipse/e4/tools/emf/ui/internal/common/component/tabs/ListTab.java	2024-03-19 10:01:56.529764403 +0100
+++ b/eclipse.platform.ui.tools/bundles/org.eclipse.e4.tools.emf.ui/src/org/eclipse/e4/tools/emf/ui/internal/common/component/tabs/ListTab.java	2024-03-19 11:39:19.103666147 +0100
@@ -30,7 +30,6 @@
 import javax.annotation.PostConstruct;
 import javax.annotation.PreDestroy;
 import javax.inject.Inject;
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.Transformer;
@@ -251,8 +250,9 @@
 		final String xml = pref.get("list-tab-xml", ""); //$NON-NLS-1$ //$NON-NLS-2$
 		if (E.notEmpty(xml)) {
 			try {
-				final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder()
-						.parse(new InputSource(new StringReader(xml)));
+				@SuppressWarnings("restriction")
+				final Document doc = org.eclipse.core.internal.runtime.XmlProcessorFactory
+						.parseWithErrorOnDOCTYPE(new InputSource(new StringReader(xml)));
 				final XPath xpath = XPathFactory.newInstance().newXPath();
 				NodeList list;
 				if (restoreColumns) {
@@ -324,7 +324,9 @@
 
 	// @Refactor
 	static private String docToString(Document doc) throws TransformerException {
-		final TransformerFactory tf = TransformerFactory.newInstance();
+		@SuppressWarnings("restriction")
+		final TransformerFactory tf = org.eclipse.core.internal.runtime.XmlProcessorFactory
+				.createTransformerFactoryWithErrorOnDOCTYPE();
 		final Transformer transformer = tf.newTransformer();
 		transformer.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes"); //$NON-NLS-1$
 		final StringWriter writer = new StringWriter();
--- a/eclipse.platform.ui.tools/bundles/org.eclipse.e4.tools.emf.ui/src/org/eclipse/e4/tools/emf/ui/internal/common/resourcelocator/TargetPlatformContributionCollector.java	2024-03-19 10:01:56.533097743 +0100
+++ b/eclipse.platform.ui.tools/bundles/org.eclipse.e4.tools.emf.ui/src/org/eclipse/e4/tools/emf/ui/internal/common/resourcelocator/TargetPlatformContributionCollector.java	2024-03-19 11:39:19.103666147 +0100
@@ -36,11 +36,11 @@
 import java.util.zip.ZipEntry;
 import java.util.zip.ZipInputStream;
 
-import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.xpath.XPath;
 import javax.xml.xpath.XPathConstants;
 import javax.xml.xpath.XPathFactory;
 
+import org.eclipse.core.internal.runtime.XmlProcessorFactory;
 import org.eclipse.core.resources.IProject;
 import org.eclipse.core.resources.IWorkspace;
 import org.eclipse.core.runtime.IPath;
@@ -86,6 +86,7 @@
  * @author Steven Spungin
  *
  */
+@SuppressWarnings("restriction")
 public abstract class TargetPlatformContributionCollector extends ClassContributionCollector {
 
 	CopyOnWriteArrayList<Entry> cacheEntry = new CopyOnWriteArrayList<>();
@@ -594,8 +595,8 @@
 			ret = new ArrayList<>();
 			outputDirectories.put(installLocation, ret);
 			try {
-				final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder()
-						.parse(new File(installLocation + File.separator + ".classpath")); //$NON-NLS-1$
+				File file = new File(installLocation + File.separator + ".classpath"); //$NON-NLS-1$
+				final Document doc = XmlProcessorFactory.parseWithErrorOnDOCTYPE(file);
 				final XPath xp = XPathFactory.newInstance().newXPath();
 				final NodeList list = (NodeList) xp.evaluate(
 						"//classpathentry[@kind='output']/@path", doc, XPathConstants.NODESET); //$NON-NLS-1$