https://trompiesec.co.uk/posts/iml-xml-external-entity-injection/