Repository: godot
Issue: Suggestion: Audit `XMLParser` for potential security issues.
Labels: discussion,topic:core

### Godot version

All

### System information

N/A

### Issue description

#### Potential security issues

While investigating the issue described in https://github.com/godotengine/godot/issues/51380 I encountered a couple of items that raised concerns around potential security issues arising from the use of `XMLParser` with untrusted XML input:

 * Heap buffer overflow occurrences recently identified/demonstrated in https://github.com/godotengine/godot/issues/48779#issuecomment-842760250.

 * The original source of the parsing code ([irrXML/ Irrlicht Engine](https://www.ambiera.com/irrxml/docu/index.html) as attributed [here](https://github.com/godotengine/godot/blob/530e069bc3efef4de535a1973aa016698ffbe334/core/io/xml_parser.h#L40)) states "The input xml file is not validated and _assumed to be correct_."

   In addition, the code was initially developed nearly 20 years ago and probably not with a malicious network-based adversary in mind as the source of the XML. (Which is especially relevant with the move to make Godot-based game servers easier.)

#### Possible approaches to mitigate the issues

In light of this, I think it would be prudent for the Godot project to:

- [ ] Audit the existing XML parsing code for potential security issues. (Perhaps via some combination of code review by general developers or security specialist developers and/or fuzzing.)
- [ ] Update `XMLParser` documentation to highlight the risks associated with and warn against processing XML input documents from untrusted sources.
- [ ]  Consider replacing the `XMLParser` code with a more known robust solution. (It seems there is already at least one other XML parser in the code base? See: [`minixml`](https://github.com/godotengine/godot/blob/8f7f5846397297fff6e8a08f89bc60ce658699cc/thirdparty/miniupnpc/miniupnpc/minixml.c). (No idea if it's any more robust.))
- [ ] Publicize confirmed issues/remediations.

It may also be a good idea to:

- [ ] Audit other file format parsing code for similar issues.

#### Additional context

**Source of original parsing code** (most recent(?) version of that code is linked):

 * [`source/Irrlicht/CXMLReaderImpl.h`](https://sourceforge.net/p/irrlicht/code/HEAD/tree/trunk/source/Irrlicht/CXMLReaderImpl.h) -- actual parsing implementation.
 * [`/include/irrXML.h`](https://sourceforge.net/p/irrlicht/code/HEAD/tree/trunk/include/irrXML.h) -- header & documentation for parsing implementation.
 * [`source/Irrlicht/CXMLReader.h`](https://sourceforge.net/p/irrlicht/code/HEAD/tree/trunk/source/Irrlicht/CXMLReader.h) -- related file.
 * [`source/Irrlicht/irrXML.cpp`](https://sourceforge.net/p/irrlicht/code/HEAD/tree/trunk/source/Irrlicht/irrXML.cpp) -- related file.

**Related Godot source** files:

 * [`core/io/xml_parser.h`](https://github.com/godotengine/godot/blob/530e069bc3efef4de535a1973aa016698ffbe334/core/io/xml_parser.h)
 * [`core/io/xml_parser.cpp`](https://github.com/godotengine/godot/blob/24ec20414a15d48ad36955e3043a1d040254c7cc/core/io/xml_parser.cpp)
 * [`tests/test_xml_parser.h`](https://github.com/godotengine/godot/blob/8f7f5846397297fff6e8a08f89bc60ce658699cc/tests/test_xml_parser.h)

**Status of other projects** that use/have used `irrXML`-based code:

 * [Assimp](https://github.com/assimp/assimp)
   * **Appear to have migrated away** to [pugixml](https://pugixml.org) ([via](https://github.com/assimp/assimp/issues/2965) & [via](https://github.com/assimp/assimp/pull/2966)).
   * Multiple references to potential security vulnerability concerns:
      * > "We got a big number of fuzzer-issues by the old xml-parser and this was the reason for me to switch to a new parser." [via](https://github.com/assimp/assimp/issues/3646#issuecomment-778067645)
      * >  " The reason to switch off the irrlicht stuff are some tests with the irrlich format. I saw a lof of memleaks in it. And I got some feedback from google, that most of their fuzz-finding were caused by the irrxml-lib." [via](https://github.com/assimp/assimp/issues/2965#issuecomment-579172571)
      * > "These trigger heap buffer overflow under ASAN or Valgrind." [via](https://github.com/assimp/assimp/issues/2894#issuecomment-575117477)
      *  https://github.com/assimp/assimp/issues/1739 
 * Qt (via Assimp)
    * see, e.g.: https://doc.qt.io/qt-5.12/qt3d-attribution-assimp-irrxml.html
    * Seems to use an older version of the code: [`qt5/qt3d/src/3rdparty/assimp/contrib/irrXML/CXMLReaderImpl.h`](https://code.woboq.org/qt5/qt3d/src/3rdparty/assimp/contrib/irrXML/CXMLReaderImpl.h.html#_ZN3irr2io14CXMLReaderImpl7setTextEPT_S3_)
 * Irrlicht Engine
    * Seems to use an updated version of the code (as linked in an earlier section) 

### Steps to reproduce

N/A

### Minimal reproduction project

_No response_