S2755 has a typo and a duplication in the description:
If you must parse untrusted XML, the best way to protect yourself is to use a local, static DTD during parsing and igore any DTD’s included in included in the document.
Also in both the compliant and non compliant code sections there are typos, which make that code not compile:
new FileInputStream(malicousSample)