XML parsing vulnerable to XXE

[jimsteel]

It seems like HAPI's XML input may be vulnerable to XXE attacks (https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing)

I'm not sure whether the use of external entities is desirable. If not, a fix like https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet#StAX_and_XMLInputFactory might be fairly simple.

[jamesagnew]

Hi Jim, thanks for the report! I had a look and yes, this is a vulnerability in both the XML parser as well as the Schema validator. Will commit a fix shortly.