fix the XXE vulnerability, we should disable external entity expansion and DTD loading when parsing untrusted XML. In libxml2, this is done by omitting the XML_PARSE_NOENT and XML_PARSE_DTDLOAD flags from the parser options. If DTDs are required for valid XML, use XML_PARSE_DTDATTR or other safer options, but never XML_PARSE_NOENT or XML_PARSE_DTDLOAD on untrusted input. The fix is to change line 384 in src/http/modules/ngx_http_xslt_filter_module.c to remove these flags, leaving only safe options such as XML_PARSE_NOWARNING. If you need to allow DTDs for validation, use XML_PARSE_DTDVALID instead, but do not allow loading external DTDs or entity expansion.

References

XML External Entity (XXE) Processing
XML External Entity Prevention Cheat Sheet
Timothy Morgen: XML Schema, DTD, and Entity Attacks
Timur Yunusov, Alexey Osipov: XML Out-Of-Band Data Retrieval