fix xml bomb