patch for webservices XXE/XEE vulnerability

solves #2174