fix xml parsing vultnerability