feat(security): disable external entity loading in SVG parser

- Initializes `XMLDocument` with `.nodeLoadExternalEntitiesNever` in `SVGParser.swift`.
- Prevents XML External Entity (XXE) attacks when parsing untrusted SVG files.
- Hardens the codebase against local file inclusion and SSRF vulnerabilities via malicious SVGs.

Author: google-labs-jules[bot]

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-22 - [XXE Protection in SVG Parser]
+**Vulnerability:** The `XMLDocument` initializer in `SVGParser.swift` used empty options `[]`, which potentially allows XML External Entity (XXE) attacks if the underlying parser defaults are permissive.
+**Learning:** Even when using higher-level abstractions like `XMLDocument`, one must explicitly disable dangerous features like external entity loading when processing untrusted input.
+**Prevention:** Always use `.nodeLoadExternalEntitiesNever` (or equivalent flags in other parsers) when parsing XML/SVG data from external sources.

Sources/SVGKit/SVGParser.swift

@@ -327,7 +327,9 @@ public final class SVGParser: @unchecked Sendable { // swiftlint:disable:this ty
             data
         }
 
-        let document = try XMLDocument(data: svgData, options: [])
+        // Disable external entity loading to prevent XXE attacks
+        let options: XMLNode.Options = [.nodeLoadExternalEntitiesNever]
+        let document = try XMLDocument(data: svgData, options: options)
         guard let root = document.rootElement(), elementName(root) == "svg" else {
             throw SVGParserError.invalidSVGRoot
         }