data.xml : disable support-dtd by default

Question

As defined by OWASP recommendations [1], both supporting-external-entities and support-dtd should be disabled by default.
While it's the case for the former (but not released as part of the 0.0.8 version), it's not the case for the latter.

Can we consider having both defined to false as part of a stable version?

[1] : https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlinputfactory-a-stax-parser.

Answer 1

Logged as https://clojure.atlassian.net/browse/DXML-74

Answer 2

By "stable" do you mean non-alpha, or non-SNAPSHOT?

Comments

According to the README, the stable version is 0.0.8, while the preview one is 0.2.0-alpha8.
I would expect either a 0.0.9 version which includes the two parameters as disabled (since it's a security issue). Or a 0.2.0 marked as the new stable version afterwards.