Drupal 6.32/7.30 are affected by XML Quadratic Blowup