yes, many XML parsing libraries doesn't have sane defaults...it is a security nightmare.