From 9658ce2d8fe8035dea844bd9955c2da4e55a37ba Mon Sep 17 00:00:00 2001
From: georgeRobertson <50412379+georgeRobertson@users.noreply.github.com>
Date: Mon, 28 Sep 2026 16:40:06 +0100
Subject: [PATCH] fix: ensure network and load_dtd are disabled in xml reading

---
 src/dve/core_engine/backends/readers/xml.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/dve/core_engine/backends/readers/xml.py b/src/dve/core_engine/backends/readers/xml.py
index badc03a0..a3fd437c 100644
--- a/src/dve/core_engine/backends/readers/xml.py
+++ b/src/dve/core_engine/backends/readers/xml.py
@@ -255,6 +255,8 @@ def _get_elements_from_stream(self, stream: IO[bytes]) -> Iterator[XMLElement]:
             remove_comments=True,
             dtd_validation=False,
             resolve_entities=False,
+            no_network=True,
+            load_dtd=False,
         )
 
         tree: etree._ElementTree = etree.parse(stream, parser)
@@ -375,6 +377,8 @@ def _get_elements_from_stream(self, stream: IO[bytes]) -> Iterator[XMLElement]:
             remove_comments=True,
             dtd_validation=False,
             resolve_entities=False,
+            no_network=True,
+            load_dtd=False,
         )
 
         container_contexts = 1 if not self.root_tag else 0