The one XML upload that read your /etc/passwd

Imagine a boring feature: your app accepts an XML upload — an invoice, a sitemap, a SOAP request, an SVG. A user sends this file: <?xml version="1.0"?> <!DOCTYPE invoice [ <!ENTITY secret SYSTEM "fi