

Nobody expects ENTITY sections in XML, either - mikeknoop
http://mikeknoop.com/lxml-xxe-exploit/

======
informatimago
The point is that nobody reads the standards.

