Java 如何使用带有字符串输入的JAXB2.0禁用DTD获取

我有以下代码（工作正常），我必须确保它的安全，并为解组过程添加一些限制

public static Response getObjectBinResponse1(String xml) throws JAXBException{
    JAXBContext jaxbContext = JAXBContext.newInstance(Response.class);
    Unmarshaller unmarshaller = jaxbContext.createUnmarshaller();
    StringReader reader = new StringReader(xml);
    Response rsp=(Response) unmarshaller.unmarshal(reader); 
    reader.close();
    return rsp;
}

我试过这个：

public static Response getObjectBinResponse2(String xml) throws JAXBException, ParserConfigurationException, SAXException, UnsupportedEncodingException{
    JAXBContext jaxbContext = JAXBContext.newInstance(Response.class);

    SAXParserFactory spf = SAXParserFactory.newInstance();
    spf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
    spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
    spf.setFeature("http://xml.org/sax/features/validation", false);


    XMLReader xmlReader = spf.newSAXParser().getXMLReader();


    InputSource inputSource = new InputSource(new StringReader(xml));
    SAXSource source = new SAXSource(xmlReader, inputSource);
    Unmarshaller unmarshaller = jaxbContext.createUnmarshaller();
    Response rsp=(Response) unmarshaller.unmarshal(source); 

    return rsp;
}

但此代码会引发以下错误：

    javax.xml.bind.UnmarshalException: unexpected element (uri:"", local:"ns0:Response"). Expected elements are <{http://www.xxx.yy/aaa/vbb/v1}Response>
    at com.sun.xml.internal.bind.v2.runtime.unmarshaller.UnmarshallingContext.handleEvent(UnmarshallingContext.java:726)
    at com.sun.xml.internal.bind.v2.runtime.unmarshaller.Loader.reportError(Loader.java:247)
    at com.sun.xml.internal.bind.v2.runtime.unmarshaller.Loader.reportError(Loader.java:242)
    at com.sun.xml.internal.bind.v2.runtime.unmarshaller.Loader.reportUnexpectedChildElement(Loader.java:109)
    at com.sun.xml.internal.bind.v2.runtime.unmarshaller.UnmarshallingContext$DefaultRootLoader.childElement(UnmarshallingContext.java:1131)
    at com.sun.xml.internal.bind.v2.runtime.unmarshaller.UnmarshallingContext._startElement(UnmarshallingContext.java:556)

我的文件package-info.java是正确的

@javax.xml.bind.annotation.XmlSchema(namespace = "http://www.xxx.yy/aaa/vbb/v1")
package my.generated.package.from.xsd.with.jaxb;

xml字符串如下所示

String xml="<?xml version=\"1.0\" encoding=\"UTF-8\"?><ns0:Response xmlns:ns0=\"http://www.xxx.yy/aaa/vbb/v1\"><enca......

对此

SAXSource source = new SAXSource(inputSource);

---

工作正常，但我需要xmlReader，因为限制已解决，在SAXParserFactory之后，有必要将setNamespaceAware=true

    SAXParserFactory spf = SAXParserFactory.newInstance();
    spf.setNamespaceAware(true);

SAXSource source = new SAXSource(inputSource);

    SAXParserFactory spf = SAXParserFactory.newInstance();
    spf.setNamespaceAware(true);