@XmlRootElement(name = "definitions")
@XmlAccessorType(XmlAccessType.FIELD)
public class BpmnDefinitions {
    @XmlAttribute
    private String id;
    
    @XmlAttribute
    private String name;
    
    @XmlElement(name = "process")
    private List<BpmnProcess> processes;
    
    // getter和setter方法
}

@XmlRootElement(name = "process")
@XmlAccessorType(XmlAccessType.FIELD)
public class BpmnProcess {
    @XmlAttribute
    private String id;
    
    @XmlAttribute
    private String name;
    
    @XmlElement(name = "startEvent")
    private List<StartEvent> startEvents;
    
    // getter和setter方法
}

DOM4J

DOM4J是一个优秀的Java XML框架：

易用性：提供简单易用的API
性能：具有良好的解析性能
XPath支持：内置强大的XPath支持
扩展性：支持自定义扩展

实现示例

public class BpmnParser {
    public BpmnModel parse(String xmlContent) {
        try {
            Document document = DocumentHelper.parseText(xmlContent);
            Element root = document.getRootElement();
            
            BpmnModel model = new BpmnModel();
            model.setId(root.attributeValue("id"));
            model.setName(root.attributeValue("name"));
            
            // 解析流程定义
            List<Element> processes = root.elements("process");
            for (Element processElement : processes) {
                BpmnProcess process = parseProcess(processElement);
                model.addProcess(process);
            }
            
            return model;
        } catch (DocumentException e) {
            throw new BpmnParseException("解析BPMN XML失败", e);
        }
    }
    
    private BpmnProcess parseProcess(Element processElement) {
        BpmnProcess process = new BpmnProcess();
        process.setId(processElement.attributeValue("id"));
        process.setName(processElement.attributeValue("name"));
        
        // 解析开始事件
        List<Element> startEvents = processElement.elements("startEvent");
        for (Element startEvent : startEvents) {
            process.addStartEvent(parseStartEvent(startEvent));
        }
        
        // 解析其他元素...
        return process;
    }
}

BPMN元素建模

将解析的XML元素转换为内存对象模型：

基础元素建模

事件元素

public abstract class BaseElement {
    protected String id;
    protected String name;
    protected Map<String, Object> extensionElements;
    
    // getter和setter方法
}

public class Event extends BaseElement {
    protected List<EventDefinition> eventDefinitions;
    
    // getter和setter方法
}

public class StartEvent extends Event {
    protected String initiator;
    
    // getter和setter方法
}

public class EndEvent extends Event {
    // 结束事件特有属性
}

活动元素

public class Activity extends FlowNode {
    protected Boolean isForCompensation;
    protected Integer startQuantity;
    protected Integer completionQuantity;
    protected Boolean isExclusive;
    
    // getter和setter方法
}

public class Task extends Activity {
    // 任务特有属性
}

public class UserTask extends Task {
    protected String assignee;
    protected List<String> candidateUsers;
    protected List<String> candidateGroups;
    
    // getter和setter方法
}

网关元素

public class Gateway extends FlowNode {
    protected GatewayDirection gatewayDirection;
    
    // getter和setter方法
}

public class ExclusiveGateway extends Gateway {
    protected String defaultFlow;
    
    // getter和setter方法
}

public class ParallelGateway extends Gateway {
    // 并行网关特有属性
}

连接元素建模

序列流

public class SequenceFlow extends BaseElement {
    protected String sourceRef;
    protected String targetRef;
    protected String conditionExpression;
    
    // getter和setter方法
}

消息流

public class MessageFlow extends BaseElement {
    protected String sourceRef;
    protected String targetRef;
    protected String messageRef;
    
    // getter和setter方法
}

语义验证实现

实现全面的语义验证确保流程定义的正确性：

静态验证

结构验证

public class BpmnValidator {
    public void validate(BpmnModel model) {
        validateProcessStructure(model);
        validateElementReferences(model);
        validateFlowIntegrity(model);
    }
    
    private void validateProcessStructure(BpmnModel model) {
        for (BpmnProcess process : model.getProcesses()) {
            // 验证每个流程必须有开始事件
            if (process.getStartEvents().isEmpty()) {
                throw new ValidationException("流程必须包含至少一个开始事件: " + process.getId());
            }
            
            // 验证每个流程必须有结束事件
            if (process.getEndEvents().isEmpty()) {
                // 注意：某些流程可能没有明确的结束事件
                // 这里需要根据具体业务规则进行判断
            }
        }
    }
    
    private void validateElementReferences(BpmnModel model) {
        Set<String> elementIds = collectAllElementIds(model);
        
        for (BpmnProcess process : model.getProcesses()) {
            // 验证序列流引用的有效性
            for (SequenceFlow flow : process.getSequenceFlows()) {
                if (!elementIds.contains(flow.getSourceRef())) {
                    throw new ValidationException("序列流源元素不存在: " + flow.getSourceRef());
                }
                if (!elementIds.contains(flow.getTargetRef())) {
                    throw new ValidationException("序列流目标元素不存在: " + flow.getTargetRef());
                }
            }
        }
    }
    
    private Set<String> collectAllElementIds(BpmnModel model) {
        Set<String> ids = new HashSet<>();
        
        for (BpmnProcess process : model.getProcesses()) {
            collectElementIds(process, ids);
        }
        
        return ids;
    }
    
    private void collectElementIds(BpmnProcess process, Set<String> ids) {
        // 收集所有元素的ID
        for (StartEvent event : process.getStartEvents()) {
            ids.add(event.getId());
        }
        
        for (Task task : process.getTasks()) {
            ids.add(task.getId());
        }
        
        for (Gateway gateway : process.getGateways()) {
            ids.add(gateway.getId());
        }
        
        for (SequenceFlow flow : process.getSequenceFlows()) {
            ids.add(flow.getId());
        }
    }
}

约束验证

public class ConstraintValidator {
    public void validateConstraints(BpmnModel model) {
        validateGatewayConstraints(model);
        validateTaskConstraints(model);
        validateEventConstraints(model);
    }
    
    private void validateGatewayConstraints(BpmnModel model) {
        for (BpmnProcess process : model.getProcesses()) {
            for (ExclusiveGateway gateway : process.getExclusiveGateways()) {
                // 验证排他网关必须有默认流出序列流或所有流出序列流都有条件
                List<SequenceFlow> outgoingFlows = getOutgoingFlows(process, gateway.getId());
                
                boolean hasDefaultFlow = gateway.getDefaultFlow() != null;
                boolean allHaveConditions = outgoingFlows.stream()
                    .allMatch(flow -> flow.getConditionExpression() != null);
                
                if (!hasDefaultFlow && !allHaveConditions) {
                    throw new ValidationException("排他网关必须有默认流出序列流或所有流出序列流都有条件: " + gateway.getId());
                }
            }
        }
    }
    
    private List<SequenceFlow> getOutgoingFlows(BpmnProcess process, String elementId) {
        return process.getSequenceFlows().stream()
            .filter(flow -> elementId.equals(flow.getSourceRef()))
            .collect(Collectors.toList());
    }
}

流程定义存储管理

内存存储模型

设计高效的内存存储模型提升访问性能：

流程定义缓存

public class ProcessDefinitionCache {
    private final Map<String, ProcessDefinition> cache = new ConcurrentHashMap<>();
    private final Map<String, List<ProcessDefinition>> versionCache = new ConcurrentHashMap<>();
    
    public void put(String processDefinitionId, ProcessDefinition definition) {
        cache.put(processDefinitionId, definition);
        
        // 按流程键缓存版本
        String processKey = definition.getKey();
        versionCache.computeIfAbsent(processKey, k -> new ArrayList<>()).add(definition);
        
        // 按版本排序
        versionCache.get(processKey).sort(Comparator.comparing(ProcessDefinition::getVersion));
    }
    
    public ProcessDefinition get(String processDefinitionId) {
        return cache.get(processDefinitionId);
    }
    
    public ProcessDefinition getLatestVersion(String processKey) {
        List<ProcessDefinition> versions = versionCache.get(processKey);
        if (versions == null || versions.isEmpty()) {
            return null;
        }
        return versions.get(versions.size() - 1);
    }
    
    public List<ProcessDefinition> getVersions(String processKey) {
        return versionCache.getOrDefault(processKey, Collections.emptyList());
    }
}

元数据管理

public class ProcessDefinitionMetadata {
    private String id;
    private String key;
    private String name;
    private int version;
    private String category;
    private String deploymentId;
    private Date deploymentTime;
    private String tenantId;
    private Map<String, Object> properties;
    
    // getter和setter方法
    
    public static class Builder {
        private ProcessDefinitionMetadata metadata = new ProcessDefinitionMetadata();
        
        public Builder id(String id) {
            metadata.setId(id);
            return this;
        }
        
        public Builder key(String key) {
            metadata.setKey(key);
            return this;
        }
        
        public Builder name(String name) {
            metadata.setName(name);
            return this;
        }
        
        public Builder version(int version) {
            metadata.setVersion(version);
            return this;
        }
        
        public ProcessDefinitionMetadata build() {
            return metadata;
        }
    }
}

持久化存储设计

设计合理的数据库表结构存储流程定义：

核心表结构

流程定义表（ACT_RE_PROCDEF）

CREATE TABLE ACT_RE_PROCDEF (
    ID_ VARCHAR(64) NOT NULL,
    REV_ INTEGER,
    CATEGORY_ VARCHAR(255),
    NAME_ VARCHAR(255),
    KEY_ VARCHAR(255) NOT NULL,
    VERSION_ INTEGER NOT NULL,
    DEPLOYMENT_ID_ VARCHAR(64),
    RESOURCE_NAME_ VARCHAR(4000),
    DGRM_RESOURCE_NAME_ VARCHAR(4000),
    DESCRIPTION_ VARCHAR(4000),
    HAS_START_FORM_KEY_ TINYINT,
    HAS_GRAPHICAL_NOTATION_ TINYINT,
    SUSPENSION_STATE_ INTEGER,
    TENANT_ID_ VARCHAR(255) DEFAULT '',
    VERSION_TAG_ VARCHAR(255),
    HISTORY_TTL_ INTEGER,
    STARTABLE_ BOOLEAN DEFAULT TRUE,
    PRIMARY KEY (ID_)
);

部署表（ACT_RE_DEPLOYMENT）

CREATE TABLE ACT_RE_DEPLOYMENT (
    ID_ VARCHAR(64) NOT NULL,
    NAME_ VARCHAR(255),
    CATEGORY_ VARCHAR(255),
    KEY_ VARCHAR(255),
    TENANT_ID_ VARCHAR(255) DEFAULT '',
    DEPLOY_TIME_ TIMESTAMP,
    DERIVED_FROM_ VARCHAR(64),
    DERIVED_FROM_ROOT_ VARCHAR(64),
    PARENT_DEPLOYMENT_ID_ VARCHAR(255),
    ENGINE_VERSION_ VARCHAR(255),
    PRIMARY KEY (ID_)
);

资源表（ACT_GE_BYTEARRAY）

CREATE TABLE ACT_GE_BYTEARRAY (
    ID_ VARCHAR(64) NOT NULL,
    REV_ INTEGER,
    NAME_ VARCHAR(255),
    DEPLOYMENT_ID_ VARCHAR(64),
    BYTES_ LONGBLOB,
    GENERATED_ TINYINT,
    TENANT_ID_ VARCHAR(255) DEFAULT '',
    PRIMARY KEY (ID_)
);

存储策略

原始XML存储

public class ProcessDefinitionStorage {
    private DataSource dataSource;
    
    public void storeProcessDefinition(ProcessDefinitionEntity definition, 
                                     String bpmnXml, 
                                     String diagramXml) {
        Connection conn = null;
        try {
            conn = dataSource.getConnection();
            conn.setAutoCommit(false);
            
            // 存储流程定义元数据
            storeProcessDefinitionMetadata(conn, definition);
            
            // 存储BPMN XML
            storeProcessDefinitionXml(conn, definition.getDeploymentId(), 
                                    definition.getResourceName(), bpmnXml);
            
            // 存储流程图XML（如果存在）
            if (diagramXml != null && definition.getDiagramResourceName() != null) {
                storeProcessDefinitionXml(conn, definition.getDeploymentId(), 
                                        definition.getDiagramResourceName(), diagramXml);
            }
            
            conn.commit();
        } catch (SQLException e) {
            if (conn != null) {
                try {
                    conn.rollback();
                } catch (SQLException rollbackEx) {
                    // 记录回滚异常
                }
            }
            throw new ProcessEngineException("存储流程定义失败", e);
        } finally {
            if (conn != null) {
                try {
                    conn.close();
                } catch (SQLException e) {
                    // 记录关闭连接异常
                }
            }
        }
    }
    
    private void storeProcessDefinitionMetadata(Connection conn, 
                                              ProcessDefinitionEntity definition) 
                                              throws SQLException {
        String sql = "INSERT INTO ACT_RE_PROCDEF (ID_, REV_, CATEGORY_, NAME_, KEY_, " +
                    "VERSION_, DEPLOYMENT_ID_, RESOURCE_NAME_, DGRM_RESOURCE_NAME_, " +
                    "DESCRIPTION_, HAS_START_FORM_KEY_, HAS_GRAPHICAL_NOTATION_, " +
                    "SUSPENSION_STATE_, TENANT_ID_) " +
                    "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
        
        try (PreparedStatement stmt = conn.prepareStatement(sql)) {
            stmt.setString(1, definition.getId());
            stmt.setInt(2, definition.getRevision());
            stmt.setString(3, definition.getCategory());
            stmt.setString(4, definition.getName());
            stmt.setString(5, definition.getKey());
            stmt.setInt(6, definition.getVersion());
            stmt.setString(7, definition.getDeploymentId());
            stmt.setString(8, definition.getResourceName());
            stmt.setString(9, definition.getDiagramResourceName());
            stmt.setString(10, definition.getDescription());
            stmt.setBoolean(11, definition.hasStartFormKey());
            stmt.setBoolean(12, definition.hasGraphicalNotation());
            stmt.setInt(13, definition.getSuspensionState());
            stmt.setString(14, definition.getTenantId());
            
            stmt.executeUpdate();
        }
    }
    
    private void storeProcessDefinitionXml(Connection conn, 
                                         String deploymentId, 
                                         String resourceName, 
                                         String xmlContent) throws SQLException {
        String sql = "INSERT INTO ACT_GE_BYTEARRAY (ID_, REV_, NAME_, DEPLOYMENT_ID_, " +
                    "BYTES_, GENERATED_, TENANT_ID_) " +
                    "VALUES (?, ?, ?, ?, ?, ?, ?)";
        
        try (PreparedStatement stmt = conn.prepareStatement(sql)) {
            String id = IdGenerator.getNextId();
            stmt.setString(1, id);
            stmt.setInt(2, 1);
            stmt.setString(3, resourceName);
            stmt.setString(4, deploymentId);
            stmt.setBytes(5, xmlContent.getBytes(StandardCharsets.UTF_8));
            stmt.setBoolean(6, false);
            stmt.setString(7, ""); // tenantId
            
            stmt.executeUpdate();
        }
    }
}

部署管理实现

部署流程设计

设计完整的部署流程确保部署的可靠性和一致性：

部署服务接口

public interface DeploymentService {
    Deployment deploy(DeploymentBuilder builder);
    Deployment deploy(String resourceName, InputStream inputStream);
    Deployment deployZip(String resourceName, InputStream zipInputStream);
    void undeploy(String deploymentId);
    DeploymentQuery createDeploymentQuery();
}

public class DeploymentBuilder {
    private String name;
    private String category;
    private String key;
    private String tenantId;
    private Map<String, InputStream> resources = new HashMap<>();
    
    public DeploymentBuilder name(String name) {
        this.name = name;
        return this;
    }
    
    public DeploymentBuilder addInputStream(String resourceName, InputStream inputStream) {
        resources.put(resourceName, inputStream);
        return this;
    }
    
    public DeploymentBuilder addClasspathResource(String resource) {
        ClassLoader classLoader = Thread.currentThread().getContextClassLoader();
        InputStream inputStream = classLoader.getResourceAsStream(resource);
        if (inputStream == null) {
            throw new FlowableException("资源未找到: " + resource);
        }
        resources.put(resource, inputStream);
        return this;
    }
    
    // getter方法
}

部署实现

public class DeploymentServiceImpl implements DeploymentService {
    private ProcessDefinitionDeployer processDefinitionDeployer;
    private DeploymentEntityManager deploymentEntityManager;
    private ProcessDefinitionEntityManager processDefinitionEntityManager;
    
    @Override
    public Deployment deploy(DeploymentBuilder builder) {
        DeploymentEntity deployment = createDeploymentEntity(builder);
        
        try {
            // 开始部署事务
            CommandContext commandContext = Context.getCommandContext();
            commandContext.getDbSqlSession().insert(deployment);
            
            // 部署资源
            for (Map.Entry<String, InputStream> entry : builder.getResources().entrySet()) {
                String resourceName = entry.getKey();
                InputStream inputStream = entry.getValue();
                
                if (resourceName.endsWith(".bpmn") || resourceName.endsWith(".bpmn20.xml")) {
                    // 部署BPMN流程定义
                    deployBpmnResource(deployment, resourceName, inputStream);
                } else if (resourceName.endsWith(".png") || resourceName.endsWith(".jpg") || 
                          resourceName.endsWith(".gif") || resourceName.endsWith(".svg")) {
                    // 部署流程图资源
                    deployDiagramResource(deployment, resourceName, inputStream);
                }
            }
            
            // 提交事务
            return deployment;
        } catch (Exception e) {
            // 回滚事务
            throw new FlowableException("部署失败: " + e.getMessage(), e);
        }
    }
    
    private void deployBpmnResource(DeploymentEntity deployment, 
                                  String resourceName, 
                                  InputStream inputStream) {
        try {
            // 读取XML内容
            String xmlContent = IoUtil.readInputStream(inputStream, resourceName);
            
            // 解析BPMN XML
            BpmnModel bpmnModel = new BpmnXMLConverter().convertToBpmnModel(
                new BytesStreamSource(xmlContent.getBytes(StandardCharsets.UTF_8)), 
                false, false);
            
            // 验证BPMN模型
            processDefinitionDeployer.validateModel(bpmnModel);
            
            // 部署流程定义
            processDefinitionDeployer.deploy(deployment, resourceName, bpmnModel);
        } catch (Exception e) {
            throw new FlowableException("部署BPMN资源失败: " + resourceName, e);
        }
    }
    
    private void deployDiagramResource(DeploymentEntity deployment, 
                                     String resourceName, 
                                     InputStream inputStream) {
        try {
            // 读取图片内容
            byte[] bytes = IoUtil.readInputStream(inputStream, resourceName);
            
            // 存储到数据库
            ResourceEntity resource = new ResourceEntity();
            resource.setName(resourceName);
            resource.setBytes(bytes);
            resource.setDeploymentId(deployment.getId());
            
            Context.getCommandContext().getDbSqlSession().insert(resource);
        } catch (Exception e) {
            throw new FlowableException("部署流程图资源失败: " + resourceName, e);
        }
    }
}

版本管理策略

实现完善的版本管理机制：

版本生成策略

public class ProcessDefinitionVersionManager {
    
    public int generateNextVersion(String processDefinitionKey, String tenantId) {
        ProcessDefinitionEntityManager processDefinitionEntityManager = 
            Context.getCommandContext().getProcessDefinitionEntityManager();
        
        // 查询相同key和tenantId的最新版本
        ProcessDefinitionEntity latest = processDefinitionEntityManager
            .findLatestProcessDefinitionByKeyAndTenantId(processDefinitionKey, tenantId);
        
        if (latest != null) {
            return latest.getVersion() + 1;
        } else {
            return 1;
        }
    }
    
    public String generateProcessDefinitionId(String processDefinitionKey, 
                                            int version, 
                                            String tenantId) {
        String id = processDefinitionKey + ":" + version;
        if (tenantId != null && !tenantId.isEmpty()) {
            id = id + ":" + tenantId;
        }
        return id;
    }
}

版本兼容性检查

public class VersionCompatibilityChecker {
    
    public boolean isCompatible(ProcessDefinitionEntity oldDefinition, 
                              ProcessDefinitionEntity newDefinition) {
        // 检查关键属性是否发生变化
        if (!Objects.equals(oldDefinition.getKey(), newDefinition.getKey())) {
            return false;
        }
        
        // 检查运行中的流程实例是否与新版本兼容
        List<ProcessInstance> runningInstances = findRunningInstances(oldDefinition.getId());
        for (ProcessInstance instance : runningInstances) {
            if (!isInstanceCompatible(instance, newDefinition)) {
                return false;
            }
        }
        
        return true;
    }
    
    private List<ProcessInstance> findRunningInstances(String processDefinitionId) {
        // 查询正在运行的流程实例
        return Context.getCommandContext()
            .getExecutionEntityManager()
            .findProcessInstancesByProcessDefinitionId(processDefinitionId);
    }
    
    private boolean isInstanceCompatible(ProcessInstance instance, 
                                       ProcessDefinitionEntity newDefinition) {
        // 检查流程实例当前活动是否在新版本中存在
        List<ExecutionEntity> executions = Context.getCommandContext()
            .getExecutionEntityManager()
            .findChildExecutionsByParentExecutionId(instance.getId());
        
        for (ExecutionEntity execution : executions) {
            if (execution.getActivityId() != null) {
                FlowElement newElement = newDefinition.getProcess()
                    .getFlowElement(execution.getActivityId());
                if (newElement == null) {
                    return false;
                }
            }
        }
        
        return true;
    }
}

最佳实践与优化建议

性能优化

解析性能优化

public class OptimizedBpmnParser {
    private static final ThreadLocal<BpmnXMLConverter> converterHolder = 
        ThreadLocal.withInitial(BpmnXMLConverter::new);
    
    public BpmnModel parseOptimized(byte[] xmlBytes) {
        BpmnXMLConverter converter = converterHolder.get();
        return converter.convertToBpmnModel(
            new BytesStreamSource(xmlBytes), false, false);
    }
    
    // 对象池管理
    private final ObjectPool<BpmnValidator> validatorPool = 
        new GenericObjectPool<>(new BpmnValidatorFactory());
    
    public void validateWithPool(BpmnModel model) {
        BpmnValidator validator = null;
        try {
            validator = validatorPool.borrowObject();
            validator.validate(model);
        } catch (Exception e) {
            throw new ProcessEngineException("验证失败", e);
        } finally {
            if (validator != null) {
                try {
                    validatorPool.returnObject(validator);
                } catch (Exception e) {
                    // 记录归还对象异常
                }
            }
        }
    }
}

缓存策略优化

public class AdvancedProcessDefinitionCache {
    private final Cache<String, ProcessDefinition> primaryCache;
    private final Cache<String, ProcessDefinition> secondaryCache;
    
    public AdvancedProcessDefinitionCache() {
        // 一级缓存：LRU缓存，容量较小但访问速度快
        primaryCache = Caffeine.newBuilder()
            .maximumSize(1000)
            .expireAfterWrite(10, TimeUnit.MINUTES)
            .build();
            
        // 二级缓存：容量较大但访问速度相对较慢
        secondaryCache = Caffeine.newBuilder()
            .maximumSize(10000)
            .expireAfterWrite(1, TimeUnit.HOURS)
            .build();
    }
    
    public ProcessDefinition getProcessDefinition(String processDefinitionId) {
        // 先从一级缓存查找
        ProcessDefinition definition = primaryCache.getIfPresent(processDefinitionId);
        if (definition != null) {
            return definition;
        }
        
        // 再从二级缓存查找
        definition = secondaryCache.getIfPresent(processDefinitionId);
        if (definition != null) {
            // 提升到一级缓存
            primaryCache.put(processDefinitionId, definition);
            return definition;
        }
        
        // 从数据库加载
        definition = loadFromDatabase(processDefinitionId);
        if (definition != null) {
            primaryCache.put(processDefinitionId, definition);
            secondaryCache.put(processDefinitionId, definition);
        }
        
        return definition;
    }
}

安全性考虑

XML安全解析

public class SecureBpmnParser {
    private static final String DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";
    private static final String EXTERNAL_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities";
    private static final String EXTERNAL_PARAMETER_ENTITIES = "http://xml.org/sax/features/external-parameter-entities";
    
    public BpmnModel parseSecure(String xmlContent) {
        try {
            SAXParserFactory factory = SAXParserFactory.newInstance();
            factory.setFeature(DISALLOW_DOCTYPE_DECL, true);
            factory.setFeature(EXTERNAL_GENERAL_ENTITIES, false);
            factory.setFeature(EXTERNAL_PARAMETER_ENTITIES, false);
            factory.setXIncludeAware(false);
            factory.setNamespaceAware(true);
            
            SAXParser parser = factory.newSAXParser();
            XMLReader reader = parser.getXMLReader();
            
            // 解析XML内容
            InputSource inputSource = new InputSource(new StringReader(xmlContent));
            // ... 实际解析逻辑
            
        } catch (Exception e) {
            throw new ProcessEngineException("安全解析BPMN XML失败", e);
        }
    }
}