Comment by pocksuppet

6 hours ago

The parser does everything for me. It helpfully loads the external URL in an inline entity definition for me. Oops! All /etc/passwd!

There are two kinds of XML parsers: those which are secure and those which are correct.