@Test @Ignore
public void parseEntityExpansionAttack() throws Exception {

    StringBuilder string0 = new StringBuilder(200)
        .append("<?xml version='1.0' encoding='iso-8859-1'?>\n")
        .append("<!DOCTYPE malicious [\n")
        .append("    <!ENTITY x0 \"\">\n")
        .append("    <!ENTITY x1 \"&x0;&x0;\">\n")
        .append("    <!ENTITY x2 \"&x1;&x1;\">\n")
        .append("    <!ENTITY x3 \"&x2;&x2;\">\n")
        .append("    <!ENTITY x4 \"&x3;&x3;\">\n")
        .append("    <!ENTITY x5 \"&x4;&x4;\">\n")
        .append("    <!ENTITY x6 \"&x5;&x5;\">\n")
        .append("    <!ENTITY x7 \"&x6;&x6;\">\n")
        .append("    <!ENTITY x8 \"&x7;&x7;\">\n")
        .append("    <!ENTITY x9 \"&x8;&x8;\">\n")
        .append("    <!ENTITY x10 \"&x9;&x9;\">\n")
        .append("    <!ENTITY x11 \"&x10;&x10;\">\n")
        .append("    <!ENTITY x12 \"&x11;&x11;\">\n")
        .append("    <!ENTITY x13 \"&x12;&x12;\">\n")
        .append("    <!ENTITY x14 \"&x13;&x13;\">\n")
        .append("    <!ENTITY x15 \"&x14;&x14;\">\n")
        .append("    <!ENTITY x16 \"&x15;&x15;\">\n")
        .append("    <!ENTITY x17 \"&x16;&x16;\">\n")
        .append("    <!ENTITY x18 \"&x17;&x17;\">\n")
        .append("    <!ENTITY x19 \"&x18;&x18;\">\n")
        .append("    <!ENTITY x20 \"&x19;&x19;\">\n")
        .append("]>\n")
        .append("<operation type=\"deliver\">\n")
        .append("<account username=\"test\" password=\"test\"/>\n")
        .append("<deliverRequest>\n")
        .append("<ticketId>&x20;test</ticketId>\n")
        .append("  <sourceAddress type=\"international\">+12065551212</sourceAddress>\n")
        .append("  <destinationAddress type=\"network\">40404</destinationAddress>\n")
        .append("  <text encoding=\"ISO-8859-1\">48656c6c6f20576f726c64</text>\n")
        .append("</deliverRequest>    \n")
        .append("</operation >\n")
        .append("");
    ByteArrayInputStream is = new ByteArrayInputStream(string0.toString().getBytes());
    SxmpParser parser = new SxmpParser();
    try {
        Operation operation = parser.parse(is);
        Assert.fail("should have thrown an exception");
    } catch (SAXParseException e) {
        // correct behavior -- only thrown if secure parsing is turned on
        // otherwise an OutOfMemoryException is thrown
    }
}