Reject PROPFIND requests with external entities with a no-external-entities precondition

[jwodder]

RFC 4918 requires that when a PROPFIND request contains any XML external entities and the server rejects it as a result, the rejection should be a 403 response of the form:

<?xml version="1.0" encoding="utf-8"?>
<error xmlns="DAV:">
    <no-external-entities />
</error>

[yarikoptic]

did we encounter any of such, e.g. as triggered by rclone or some other FUSE system?

[jwodder]

@yarikoptic I don't believe so. The only clients that would ever send bodies with external entities would be malicious. At the moment, it seems that the xml-rs library that dandidav uses for parsing XML simply ignores any external entities.