如何配置org.apache.cxf.jaxrs.provider.JAXBElementProvider以防止XXE攻击

JAXBElementProvider provider = new JAXBElementProvider();
provider.setDisableExternalEntities(true);

JAXBElementProvider provider = new JAXBElementProvider();
provider.setXMLReaderCreator(new XMLReaderCreator() {
    @Override
    public XMLReader createXMLReader() {
        SAXParserFactory factory = SAXParserFactory.newInstance();
        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        XMLReader reader = factory.newSAXParser().getXMLReader();
        return reader;
    }
});