fix: ensure network and load_dtd are disabled in xml reading

Author: georgeRobertson

src/dve/core_engine/backends/readers/xml.py

@@ -255,6 +255,8 @@ def _get_elements_from_stream(self, stream: IO[bytes]) -> Iterator[XMLElement]:
             remove_comments=True,
             dtd_validation=False,
             resolve_entities=False,
+            no_network=True,
+            load_dtd=False,
         )
 
         tree: etree._ElementTree = etree.parse(stream, parser)
@@ -375,6 +377,8 @@ def _get_elements_from_stream(self, stream: IO[bytes]) -> Iterator[XMLElement]:
             remove_comments=True,
             dtd_validation=False,
             resolve_entities=False,
+            no_network=True,
+            load_dtd=False,
         )
 
         container_contexts = 1 if not self.root_tag else 0