This code is a copy-paste of ``Symfony\Component\Serializer\Encoder\XmlEncoder`` (half of the class as the other half is about encoding into XML), but without the security fixes applied in 2.0.17 (which means it is vulnerable, especially as it is always used on untrusted XML).
Would it make sense to use the Symfony code instead