“In the case of Java, you need to write a piece of code to forbid parsing external entities.”

Transcript evidence from Katy Anton -- OWASP Top 10 #4 XXE.