diff --git a/src/main/java/org/apache/ibatis/parsing/XPathParser.java b/src/main/java/org/apache/ibatis/parsing/XPathParser.java
index eaff8c0dc31..35905efbb61 100644
--- a/src/main/java/org/apache/ibatis/parsing/XPathParser.java
+++ b/src/main/java/org/apache/ibatis/parsing/XPathParser.java
@@ -231,13 +231,16 @@ private Document createDocument(InputSource inputSource) {
     try {
       DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
       factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+      factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+      factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+      factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
       factory.setValidating(validation);
 
       factory.setNamespaceAware(false);
       factory.setIgnoringComments(true);
       factory.setIgnoringElementContentWhitespace(false);
       factory.setCoalescing(false);
-      factory.setExpandEntityReferences(true);
+      factory.setExpandEntityReferences(false);
 
       DocumentBuilder builder = factory.newDocumentBuilder();
       builder.setEntityResolver(entityResolver);