title: Improper Restriction of XML EER for TransformerFactory
body: <p>Getting Veracode vulnerability &quot;Improper Restriction of XML External Entity Reference&quot; for &quot;TransformerFactory&quot;, There are several solution for this and the most relevant I found is: <a href="https://stackoverflow.com/questions/58374278/org-xml-sax-saxnotrecognizedexception-property-http-javax-xml-xmlconstants-p">solution</a>. But after trying these solution none of them worked. Below is the code:</p>
  <pre><code>import net.sf.saxon.TransformerFactoryImpl;
  .....
   TransformerFactory genericFactory = TransformerFactoryImpl.newInstance();
   genericFactory.setFeature(&quot;http://javax.xml.XMLConstants/property/accessExternalDTD&quot;, false);  
   genericFactory.setFeature(Constants.FEATURE_SECURE_PROCESSING,true);
  </code></pre>
  <p>The error is:</p>
  <pre><code>javax.xml.transform.TransformerConfigurationException: Unsupported TransformerFactory feature: http://javax.xml.XMLConstants/property/accessExternalDTD
  </code></pre>
  <p>Currently I am running the application on Java 8 and the relevant jars are:
  saxon9.jar,
  xalan-2.7.2.jar</p>
  <p>I tried several combination for these like:</p>
  <pre><code>//1
   TransformerFactory genericFactory = javax.xml.transform.TransformerFactory.newInstance();
   genericFactory.setFeature(&quot;http://javax.xml.XMLConstants/property/accessExternalDTD&quot;, false);  
  //2
   TransformerFactory genericFactory = com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl.newInstance();
   genericFactory.setFeature(&quot;http://javax.xml.XMLConstants/property/accessExternalDTD&quot;, false);
  </code></pre>
  <p>But getting the same error. How to solve this error?</p>