@Test
  public void testFailOnExternalEntities() throws Exception {
    final String externalEntitiesXml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
      + " <!DOCTYPE foo [ <!ENTITY xxe SYSTEM \"/tmp/foo\"> ] >"
      + " <ClusterVersion>&xee;</ClusterVersion>";
    Client client = mock(Client.class);
    RemoteAdmin admin = new RemoteAdmin(client, HBaseConfiguration.create(), null);
    Response resp = new Response(200, null, Bytes.toBytes(externalEntitiesXml));

    when(client.get("/version/cluster", Constants.MIMETYPE_XML)).thenReturn(resp);

    try {
      admin.getClusterVersion();
      fail("Expected getClusterVersion() to throw an exception");
    } catch (IOException e) {
      assertEquals("Cause of exception ought to be a failure to parse the stream due to our "
        + "invalid external entity. Make sure this isn't just a false positive due to "
        + "implementation. see HBASE-19020.", UnmarshalException.class, e.getCause().getClass());
      final String exceptionText = StringUtils.stringifyException(e);
      final String expectedText = "\"xee\"";
      LOG.debug("exception text: '" + exceptionText + "'", e);
      assertTrue("Exception does not contain expected text", exceptionText.contains(expectedText));
    }
  }
Test class for {@link RemoteAdmin} to verify XML is parsed in a certain manner.
hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/client/TestXmlParsing.java