Fix XXE_SAXPARSER SpotBugs violations (#6052)

core/src/main/java/hudson/XmlFile.java

@@ -52,6 +52,7 @@ import java.util.Map;
 import java.util.function.Supplier;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import javax.xml.XMLConstants;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParserFactory;
 import org.apache.commons.io.IOUtils;
@@ -320,7 +321,11 @@ public final class XmlFile {
         try (InputStream in = Files.newInputStream(file.toPath())) {
             InputSource input = new InputSource(file.toURI().toASCIIString());
             input.setByteStream(in);
-            JAXP.newSAXParser().parse(input,new DefaultHandler() {
+            SAXParserFactory spf = SAXParserFactory.newInstance();
+            spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            spf.setNamespaceAware(true);
+            spf.newSAXParser().parse(input, new DefaultHandler() {
                 private Locator loc;
                 @Override
                 public void setDocumentLocator(Locator locator) {
@@ -372,13 +377,7 @@ public final class XmlFile {
 
     private static final Logger LOGGER = Logger.getLogger(XmlFile.class.getName());
 
-    private static final SAXParserFactory JAXP = SAXParserFactory.newInstance();
-
     private static final HierarchicalStreamDriver DEFAULT_DRIVER = XStream2.getDefaultDriver();
 
     private static final XStream DEFAULT_XSTREAM = new XStream2(DEFAULT_DRIVER);
-
-    static {
-        JAXP.setNamespaceAware(true);
-    }
 }