From 0cd51dd5a48dc4155796ecf7438bd9dcb9f9b671 Mon Sep 17 00:00:00 2001
From: Craig L Russell <apache.clr@gmail.com>
Date: Thu, 25 Jun 2026 16:36:49 -0700
Subject: [PATCH] Update JDOHelper.java to resolve security issue

Change the getDefaultDocumentBuilderFactory xml handling to disable ExpandEntityReferences
---
 api/src/main/java/javax/jdo/JDOHelper.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/src/main/java/javax/jdo/JDOHelper.java b/api/src/main/java/javax/jdo/JDOHelper.java
index c0bb0385..ab17ab92 100644
--- a/api/src/main/java/javax/jdo/JDOHelper.java
+++ b/api/src/main/java/javax/jdo/JDOHelper.java
@@ -1153,7 +1153,7 @@ protected static DocumentBuilderFactory getDefaultDocumentBuilderFactory() {
     factory.setNamespaceAware(true);
     factory.setValidating(false);
     factory.setIgnoringElementContentWhitespace(true);
-    factory.setExpandEntityReferences(true);
+    factory.setExpandEntityReferences(false);
 
     return factory;
   }