fix null pointer dereference
prevent XXE attacks
add XXE information