package scan

import (
	"encoding/xml"
	"io"
)

// newSafeXMLDecoder disables external entity expansion so parseRSSItems is
// XXE-safe even when a malicious feed is served.
func newSafeXMLDecoder(r io.Reader) *xml.Decoder {
	d := xml.NewDecoder(r)
	d.Strict = false
	d.Entity = map[string]string{} // no external/named entity resolution
	return d
}