[java] Preventing XXE when loading Firefox extensions.

See https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html

Author: barancev

java/client/src/org/openqa/selenium/firefox/FileExtension.java

@@ -161,6 +161,7 @@ private String readIdFromInstallRdf(File root) {
       File installRdf = new File(root, "install.rdf");
 
       DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+      factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
       factory.setNamespaceAware(true);
       factory.setExpandEntityReferences(false);
       DocumentBuilder builder = factory.newDocumentBuilder();