Add helper method to XmlUtil to enable XXE protection in the SAXParserFactory and XMLInputFactory (4.2)

[joschi]

Backport (git cherry-pick [...]) of the changes in #20407 into the Hazelcast 4.2.z version branch.

Fixes #20928 (for 4.2.z branch)

Backport of: #20407

Checklist:

• Labels (Team:, Type:, Source:, Module:) and Milestone set
• Label Add to Release Notes or Not Release Notes content set
• Request reviewers if possible
• Send backports/forwardports if fix needs to be applied to past/future releases
• New public APIs have @Nonnull/@Nullable annotations
• New public APIs have @since tags in Javadoc

[devOpsHazelcast]

Can one of the admins verify this patch?

[kwart]

run-lab-run

[hz-devops-test]

The job Hazelcast-pr-builder of your PR failed. (Hazelcast internal details: build log, artifacts).
Through arcane magic we have determined that the following fragments from the build log may contain information about the problem.

Click to expand the log file

--------------------------
---------SUMMARY----------
--------------------------
[ERROR] COMPILATION ERROR : 
--------------------------
[ERROR] /home/jenkins/jenkins_slave/workspace/Hazelcast-pr-builder_3/hazelcast/src/test/java/com/hazelcast/internal/memory/impl/BaseMemoryAccessorTest.java:[28,15] Unsafe is internal proprietary API and may be removed in a future release
--------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:2.5.1:testCompile (default-testCompile) on project hazelcast: Compilation failure: Compilation failure: 
--------------------------
---------ERRORS-----------
--------------------------
[ERROR] /home/jenkins/jenkins_slave/workspace/Hazelcast-pr-builder_3/hazelcast/src/test/java/com/hazelcast/internal/memory/impl/BaseMemoryAccessorTest.java:[28,15] Unsafe is internal proprietary API and may be removed in a future release
--------------------------
[ERROR] /home/jenkins/jenkins_slave/workspace/Hazelcast-pr-builder_3/hazelcast/src/test/java/com/hazelcast/internal/memory/impl/BaseMemoryAccessorTest.java:[28,15] Unsafe is internal proprietary API and may be removed in a future release
--------------------------
[ERROR] /home/jenkins/jenkins_slave/workspace/Hazelcast-pr-builder_3/hazelcast/src/test/java/com/hazelcast/internal/util/XmlUtilTest.java:[45,29] error: package org.fusesource.hawtbuf does not exist
--------------------------
[ERROR] /home/jenkins/jenkins_slave/workspace/Hazelcast-pr-builder_3/hazelcast/src/test/java/com/hazelcast/internal/memory/impl/BaseMemoryAccessorTest.java:[28,15] Unsafe is internal proprietary API and may be removed in a future release
--------------------------
[ERROR] /home/jenkins/jenkins_slave/workspace/Hazelcast-pr-builder_3/hazelcast/src/test/java/com/hazelcast/internal/memory/impl/BaseMemoryAccessorTest.java:[28,15] Unsafe is internal proprietary API and may be removed in a future release
--------------------------
[ERROR] /home/jenkins/jenkins_slave/workspace/Hazelcast-pr-builder_3/hazelcast/src/test/java/com/hazelcast/internal/memory/impl/BaseMemoryAccessorTest.java:[28,15] Unsafe is internal proprietary API and may be removed in a future release
--------------------------
[ERROR] /home/jenkins/jenkins_slave/workspace/Hazelcast-pr-builder_3/hazelcast/src/test/java/com/hazelcast/internal/util/XmlUtilTest.java:[45,29] error: package org.fusesource.hawtbuf does not exist
--------------------------
[ERROR] /home/jenkins/jenkins_slave/workspace/Hazelcast-pr-builder_3/hazelcast/src/test/java/com/hazelcast/internal/memory/impl/BaseMemoryAccessorTest.java:[28,15] Unsafe is internal proprietary API and may be removed in a future release
--------------------------

[kwart]

run-lab-run

[kwart]

LGTM. Thanks for the backport.

[hutupro]

When will version 4.2.5 be released?