SAXParserFactory doesn't disable XML entity expansion

The DocumentBuilderFactory and XmlInputFactory providers aren't vulnerable to Billion Laughs attacks (exponential entity expansion) by disabling entity expansion altogether.

But the SAXParserFactory provider is only disabling external entities, and it's possible to use the following input to generate a very high memory consumption (specially if the application using it allows parallel requests):

```

]>

FIRST NAME &lol6;

```

There is I actually a limit, but very high (like 100000 I think, and couldn't configure it with the entityExpansionLimit JDK property). If it doesn't work try removing the last level of recursion. Even if the depth is limited, there is no maximum for the expanded size so adding a few kilobytes to the entity text would make the attack successful.

Check disallow-doctype-decl feature in this example:
[https://gist.github.com/asudhakar02/45e2e6fd8bcdfb4bc3b2](https://gist.github.com/asudhakar02/45e2e6fd8bcdfb4bc3b2)
#### Affected Versions
[2.24]