XML security patch