csrf-fix: parser to find closing cdata