SECURITY: Whitelist DTD declaration in SVG