From b3943316b8b7b9085058a806d7b0ba9e1d303c6c Mon Sep 17 00:00:00 2001
From: MinhHK68 <-ErrorAction>
Date: Sun, 12 Jul 2026 11:45:21 +0700
Subject: [PATCH] code cleanup

---
 .../dataverse/api/ldn/COARNotifyRelationshipAnnouncement.java   | 2 +-
 .../AuthenticationProvidersRegistrationServiceBean.java         | 2 +-
 .../authorization/providers/oauth2/impl/OrcidOAuth2AP.java      | 2 +-
 .../dataverse/authorization/providers/shib/ShibServiceBean.java | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/main/java/edu/harvard/iq/dataverse/api/ldn/COARNotifyRelationshipAnnouncement.java b/src/main/java/edu/harvard/iq/dataverse/api/ldn/COARNotifyRelationshipAnnouncement.java
index 84f5702cf40..d4acf9d90c2 100644
--- a/src/main/java/edu/harvard/iq/dataverse/api/ldn/COARNotifyRelationshipAnnouncement.java
+++ b/src/main/java/edu/harvard/iq/dataverse/api/ldn/COARNotifyRelationshipAnnouncement.java
@@ -246,7 +246,7 @@ private void parseDataCiteXml(String dataciteXmlUrl, CloseableHttpClient client,
                 String xmlContent = EntityUtils.toString(xmlResponse.getEntity(), "UTF-8");
                 logger.fine("Retrieved DataCite XML");
 
-                javax.xml.parsers.DocumentBuilderFactory factory = javax.xml.parsers.DocumentBuilderFactory.newInstance();
+                javax.xml.parsers.DocumentBuilderFactory factory = edu.harvard.iq.dataverse.util.xml.XmlUtil.getSecureDocumentBuilderFactory();
                 factory.setNamespaceAware(true);
                 javax.xml.parsers.DocumentBuilder builder = factory.newDocumentBuilder();
                 org.w3c.dom.Document doc = builder.parse(
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/AuthenticationProvidersRegistrationServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/authorization/AuthenticationProvidersRegistrationServiceBean.java
index 99586b59d07..60fa0812216 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/AuthenticationProvidersRegistrationServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/AuthenticationProvidersRegistrationServiceBean.java
@@ -395,7 +395,7 @@ private String lookupShibbolethEntityId() {
         XMLStreamReader xmlr = null;
 
         try {
-            XMLInputFactory xmlFactory = javax.xml.stream.XMLInputFactory.newInstance();
+            XMLInputFactory xmlFactory = edu.harvard.iq.dataverse.util.xml.XmlUtil.getSecureXMLInputFactory();
             xmlr =  xmlFactory.createXMLStreamReader(new InputStreamReader((InputStream) metadataRequest.getInputStream()));
             
             while ( xmlr.next() == XMLStreamConstants.COMMENT);
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/impl/OrcidOAuth2AP.java b/src/main/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/impl/OrcidOAuth2AP.java
index f32ff2b18e5..94946f881f6 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/impl/OrcidOAuth2AP.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/providers/oauth2/impl/OrcidOAuth2AP.java
@@ -286,7 +286,7 @@ protected Optional<AuthenticatedUserDisplayInfo> getOrganizationalData(OAuth2Acc
     }
     
     protected AuthenticatedUserDisplayInfo parseActivitiesResponse( String responseBody ) {
-        DocumentBuilderFactory dbFact = DocumentBuilderFactory.newInstance();
+        DocumentBuilderFactory dbFact = edu.harvard.iq.dataverse.util.xml.XmlUtil.getSecureDocumentBuilderFactory();
         
         try ( StringReader reader = new StringReader(responseBody)) {
             DocumentBuilder db = dbFact.newDocumentBuilder();
diff --git a/src/main/java/edu/harvard/iq/dataverse/authorization/providers/shib/ShibServiceBean.java b/src/main/java/edu/harvard/iq/dataverse/authorization/providers/shib/ShibServiceBean.java
index 0a0d154a64e..bee1ae38b5c 100644
--- a/src/main/java/edu/harvard/iq/dataverse/authorization/providers/shib/ShibServiceBean.java
+++ b/src/main/java/edu/harvard/iq/dataverse/authorization/providers/shib/ShibServiceBean.java
@@ -221,7 +221,7 @@ public String getAffiliationViaMDQ(String shibIdp) {
         XMLStreamReader xmlr = null;
 
         try {
-            XMLInputFactory xmlFactory = javax.xml.stream.XMLInputFactory.newInstance();
+            XMLInputFactory xmlFactory = edu.harvard.iq.dataverse.util.xml.XmlUtil.getSecureXMLInputFactory();
             xmlr =  xmlFactory.createXMLStreamReader(new InputStreamReader((InputStream) mdqApiRequest.getInputStream()));
             
             while ( xmlr.next() == XMLStreamConstants.COMMENT );