[ https://issues.jboss.org/browse/TEIID-2911?page=com.atlassian.jira.plugin... ] Steven Hawkins commented on TEIID-2911: --------------------------------------- In looking at this a bit more, I believe the entity expansion is taking place in the odata4j layer - not RESTEasy. As you dig through the parser is created with XMLInputFactory.newInstance(), which I believe we would need to get javax.xml.stream.isSupportingExternalEntities=false passed to. The default is unspecified so I'm not sure if woodstox supports that by default or if there is a system wide way to disable. I believe the same would hold true for Teiid's own usage of XMLInputFactory.newInstance - it may be allowing SQL/XML to resolve external entities as well. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira