Updated documentation for XXE injection in readers