fix: disable downloading of DTD in W3CQuery

new: SimpleStreamer#expect

assira/src/main/java/net/ranides/assira/lexer/SimpleStreamer.java

@@ -106,6 +106,18 @@ public class SimpleStreamer {
         return new String(content, begin, position - begin);
     }
 
+    public boolean expect(String value) {
+        int n = value.length();
+        if(position+ n > content.length) {
+            return false;
+        }
+        if(value.equals(peek(n))) {
+            skip(n);
+            return true;
+        }
+        return false;
+    }
+
     private Matcher matcher(Pattern regex) {
         return regex.matcher(StringUtils.wrap(content, position, content.length));
     }

assira/src/main/java/net/ranides/assira/xml/impl/W3CQuery.java

@@ -104,6 +104,7 @@ public final class W3CQuery {
     private static DocumentBuilder builder() throws ParserConfigurationException {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
         factory.setNamespaceAware(true);
+        factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
         return factory.newDocumentBuilder();
     }