fix against XXE flaw