I have the exact same problem. The flow goes:
org.jboss.wsf.stack.jbws.RequestHandlerImpl.processRequest(ln: 447)
org.jboss.ws.core.soap.MessageFactoryImpl.createMessage(ln: 275)
At this point the ServiceLoader will find the impl class for EnvelopeBuilder, which is "org.jboss.ws.core.soap.EnvelopeBuilderDOM". This class uses "org.jboss.wsf.common.DOMUtils" to parse the SOAP envelope, which has this: (ln: 95)
String[] resolvers = { "org.jboss.ws.core.utils.JBossWSEntityResolver", "org.jboss.util.xml.JBossEntityResolver" };
I can't see how this can be easily configured as the "org.jboss.wsf.common.DOMUtils" class has hard-coded the EntityResolvers to be "org.jboss.ws.core.utils.JBossWSEntityResolver" or "org.jboss.util.xml.JBossEntityResolver" (which the latter would be used if both are available). Both of these would read an inputSource when entities are defined. (e.g. read a file)
After a fair bit of digging I think either you:
(1) implement filters to block / filter ENTITY requests on the way in.
(2) Define your own "org.jboss.ws.core.soap.EnvelopeBuilder" impl class, which can be done by overriding "META-INF/services/org.jboss.ws.core.soap.EnvelopeBuilder" file in "jbossws-core.jar", in which you can specify your own DOMUtils with a custom EntityResolver.
Hope this helps.