https://foojay.io/today/hacking-java-xml-input-via-external-entity-injection/