Enable secure processing on the shared SAX parser factory

The factory already refuses a doctype declaration and external DTD
loading. Secure processing is the JAXP-standard switch that sits under
both, so set it alongside them rather than relying on the parser
implementation's default.

It is set last so that a parser which does not recognise the feature
cannot stop the two settings above it from being applied.

Claude-Session: https://claude.ai/code/session_019R1jdtwkaYEeA6L9DXEtEi

app/src/main/java/org/apache/roller/weblogger/business/WebloggerImpl.java

diff --git a/app/src/main/java/org/apache/roller/weblogger/business/WebloggerImpl.java b/app/src/main/java/org/apache/roller/weblogger/business/WebloggerImpl.java
index 4dcb1b5..14e65a9 100644
--- a/app/src/main/java/org/apache/roller/weblogger/business/WebloggerImpl.java
+++ b/app/src/main/java/org/apache/roller/weblogger/business/WebloggerImpl.java
@@ -35,6 +35,7 @@
 import org.xml.sax.SAXNotRecognizedException;
 import org.xml.sax.SAXNotSupportedException;
 
+import javax.xml.XMLConstants;
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParserFactory;
 
@@ -368,6 +369,7 @@
         try {
             spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
             spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
         } catch (ParserConfigurationException | SAXNotRecognizedException | SAXNotSupportedException e) {
             String message = "Unable to turn off External DTD support in SAXParser. XML-RLC is vulnerable";
             if ( log.isDebugEnabled() ) {