Xxe

Lab DocumentBuilder/TransformerFactory features to disable, tiny file:// entity to a lab file, parser throws or ignores — no FTP exfil.