Suggest creating a new category 'xml' and dumping the unsafe extensions there ('html','htm','xhtml', 'xml'). https://github.com/silverstripe/silverstripe-framework/blob/3.1/docs/en/reference/uploadfield.md#limit-the-allowed-filetypes needs updating too, 'doc' will no longer include html types.