title: Disallow entity declarations but allow DTDs
body: <p>I am given an XML document that must be allowed to have a Document Type Declaration (DTD), but we prohibit any ENTITY declarations.</p>
  
  <p>The XML document is parsed with <code>SAXParser.parse()</code>, as follows:</p>
  
  <pre><code>SAXParserFactory factory = SAXParserFactory.newInstance();
  
  factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
  factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
  factory.setValidating(true);
  
  SAXParser parser = factory.newSAXParser();
  </code></pre>
  
  <p>The XML is then passed into the parser as an <code>InputSource</code>:</p>
  
  <pre><code>InputSource inputSource= ... ;
  parser.parse(inputSource, handler);
  </code></pre>
  
  <p>And the <code>handler</code> has a <code>resolveEntity</code> method, which <code>SAXParser.parse()</code> calls:</p>
  
  <pre><code>public InputSource resolveEntity(String pubID, String sysID) throws SAXException {
    InputSource inputSource = null;
    try {
       inputSource = entityResolver.resolveEntity(publicId, systemId);
    }
    catch (IOException e) {
       throw new SAXException(e);
    }
    return inputSource;
  }
  </code></pre>
  
  <p>When I pass in an XML file with an ENTITY reference, it seems that nothing is being done - no exceptions are thrown and nothing is stripped - to or about the prohibited ENTITY reference.</p>
  
  <p>Here is an example of the bad XML I am using. The DTD should be allowed, but the !ENTITY line should be disallowed:</p>
  
  <pre><code>&lt;!DOCTYPE foo SYSTEM "foo.dtd" [
      &lt;!ENTITY gotcha SYSTEM "file:///gotcha.txt"&gt; &lt;!-- This is disallowed--&gt;
  ]&gt;
  
  &lt;label&gt;&amp;gotcha;&lt;/label&gt;
  </code></pre>
  
  <p>What do I need to do to make sure that ENTITY references are disallowed in the XML, but that DTDs are still allowed?</p>