The test required the parser to parse a payload that names an external entity
and to leave the system identifier of that entity in the document. That is one
way to keep the contents of the named file out of the document, and it is the
way the parser behaves today, but it is not the contract. The contract is that
the contents never arrive.
Assert that instead: the contents reach neither the document nor the error. A
parser that refuses the payload keeps the contract as well as a parser that
parses it and leaves the entity alone.
Behaviour does not change. The test passes against this branch and against the
current parser.
The test sends a document whose external SYSTEM entity points at a secret file.
It exercises both parser paths: the modern XML::Simple path and the older
compatibility path. Each path must parse the document, replace the entity with
its system identifier, and not read the file contents.
Vinícius Ferrão