I think XXE would have been fine if it followed the same rules as ajax does in web browsers. Although i guess it is a glaring example of xml not being sure what

I think XXE would have been fine if it followed the same rules as ajax does in web browsers. Although i guess it is a glaring example of xml not being sure what level of abstraction its trying to be. The real wtf is recursive entity expansion (billion laughs)