Xml external entity injection

[QiAnXinCodeSafe]

The Domparser method in the InvokeDecoder.java uses the xml parser to parse the xml string without disabling the xml external entity, causing the attacker to construct a malicious xml string for the xce attack .

The same problem exists in SAXParser.java and XMLConfig.java