@Test
    @Timeout(30000)
    public void testProtectedXML() throws Exception {
        byte[] bytes = "<?xml version=\"1.0\" encoding=\"UTF-8\"?><document>blah</document>"
                .getBytes(StandardCharsets.UTF_8);
        byte[] injected = injectXML(bytes, ENTITY_EXPANSION_BOMB);

        ParseContext context = new ParseContext();
        for (int i = 0; i < XMLReaderUtils.getPoolSize() * 2; i++) {
            test("default", injected, AUTO_DETECT_PARSER, context);
        }
        context.set(SAXParserFactory.class, XMLReaderUtils.getSAXParserFactory());
        for (int i = 0; i < XMLReaderUtils.getPoolSize() * 2; i++) {
            test("default sax", injected, AUTO_DETECT_PARSER, context);
        }
        String provider = "com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl";
        // create a new SAXParserFactory
        SAXParserFactory factory = null;
        try {
            factory = SAXParserFactory.newInstance(provider, null);
        } catch (Exception e) {
            return;
        }
        factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        context.set(SAXParserFactory.class, factory);
        for (int i = 0; i < XMLReaderUtils.getPoolSize() * 2; i++) {
            test("built-in SAX", injected, AUTO_DETECT_PARSER, context);
        }
    }
Tests to confirm defenses against entity expansion attacks.
tika-parsers/tika-parsers-standard/tika-parsers-standard-package/src/test/java/org/apache/tika/parser/TestXMLEntityExpansion.java