SAXParseException (JAXP00010004) loading html.xml dictionary on JDK 25 — accumulated entity expansion exceeds jdk.xml.totalEntitySizeLimit

[ghedwards]

SyntaxDictionary.loadDictionary() fails on JDK 25 with:

org.xml.sax.SAXParseException: JAXP00010004: The accumulated size of
entities is "100,003" that exceeded the "100,000" limit set by
"jdk.xml.totalEntitySizeLimit".
systemId: .../org.cfeclipse.cfml/dictionary/inc/parameter_html_event_mouse.ixml
    at cfml.dictionary.SyntaxDictionary.loadDictionary(SyntaxDictionary.java:561)

This happens at dictionary load time (i.e. on construction of any
CFMLParser), independent of what's actually being scanned - confirmed via
CFLint on both a plain jar and a GraalVM native-image build. JDK 21 does not
hit this; something in JDK 25's XML stack tightened the effective default for
jdk.xml.totalEntitySizeLimit enough to trip on this dictionary's existing
XML structure.

Root cause: html.xml's DOCTYPE declares several shared "attribute
group" entities (event_mouse, core, lang, event_keyboard, keyboard,
event_focus, event_form, event_window), each pulled in via external
SYSTEM entities and &entity;-referenced across ~90 HTML tag definitions -
335 references total (core: 83, lang: 84, event_mouse/
event_keyboard: 72 each, etc.). Each individual reference is small, but the
accumulated expansion crosses the JDK 25 default.

Where: SyntaxDictionary.java:554-557 configures the SAXParserFactory/
XMLReader with no entity-expansion-limit override at all, so it silently
inherits whatever jdk.xml.totalEntitySizeLimit happens to default to on the
running JDK.

Suggested fix - set a generous, explicit limit on this specific parser
instance (scoped, so it doesn't affect any other XML parsing a consuming
application might do):

final XMLReader xmlReader = factory.newSAXParser().getXMLReader();
xmlReader.setProperty("http://www.oracle.com/xml/jaxp/properties/totalEntitySizeLimit", "10000000");

Happy to send a PR for this if useful.