Fix #2589

Author: cowtowncoder

release-notes/CREDITS-2.x

@@ -1051,3 +1051,8 @@ Joseph Koshakow (jkosh44@github)
 Haowei Wen (yushijinhun@github)
   * Reported #2565: Java 8 `Optional` not working with `@JsonUnwrapped` on unwrappable type
  (2.11.0)
+
+Bartosz Baranowski (baranowb@github)
+  * Reported #2589: `DOMDeserializer`: setExpandEntityReferences(false) may not prevent
+   external entity expansion in all cases
+ (2.11.0)

release-notes/VERSION-2.x

@@ -34,6 +34,9 @@ Project: jackson-databind
  (reported by Haowei W)
 #2573: Add `MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES` to allow blocking
   use of unsafe base type for polymorphic deserialization
+#2589: `DOMDeserializer`: setExpandEntityReferences(false) may not prevent
+  external entity expansion in all cases
+ (reported by Bartosz B)
 - Add `SerializerProvider.findContentValueSerializer()` methods
 
 2.10.2 (05-Jan-2020)

src/main/java/com/fasterxml/jackson/databind/ext/DOMDeserializer.java

@@ -39,6 +39,14 @@ public abstract class DOMDeserializer<T> extends FromStringDeserializer<T>
             // 14-Jul-2016, tatu: Not sure how or why, but during code coverage runs
             //   (via Cobertura) we get `java.lang.AbstractMethodError` so... ignore that too
         }
+
+        // [databind#2589] add two more settings just in case
+        try {
+            parserFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        } catch (Throwable t) { } // as per previous one, nothing much to do
+        try {
+            parserFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        } catch (Throwable t) { } // as per previous one, nothing much to do
         DEFAULT_PARSER_FACTORY = parserFactory;
     }