Fix XXE security issue