CONN-911: fix for external entity injection.