BZ1158017 - prevent processing of external entities