patch for webservice XXE/XEE vulnerability

solves #2174