XML bomb protection for Python stdlib modules