Currently some codepoints use a native javax.xml.parsers.DocumentBuilderFactory or javax.xml.stream.XMLInputFactory. Restriction of XML External Entity Reference is lacking.

• org/jboss/as/jdr/util/XMLSanitizer

Fix:
Use o.w.c.xml.*Factories

Related to:

• https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
• https://docs.oracle.com/en/java/javase/13/security/java-api-xml-processing-jaxp-security-guide.html#GUID-3FB69003-1E4A-435C-B519-4B9D07630460