update docs

Author: amitguptagwl

docs/v4, v5/2.XMLparseOptions.md

@@ -382,7 +382,16 @@ If your XML has NCR(Numeric Character Reference) in XML document then the respon
 
 You can read more detail for advance handling in [@nodable/entities](https://github.com/nodable/val-parsers/blob/main/Entity/docs/EntityDecoder.md) configuration.
 
-> ⚠️ It is advisable to use the `postCheck` function to safely handle malicious data.
+
+### Note
+- ⚠️ It is advisable to use the `postCheck` function to safely handle malicious data.
+- FXP overrides `onInputEntity` to check entity value if marked unsafe by [is-unsafe](library). You may override for better protection of your project specific security.
+```js
+onInputEntity: (name, value) =>
+          isUnsafe(value, [VALID_CONTEXTS.HTML, VALID_CONTEXTS.XML])
+            ? ENTITY_ACTION.BLOCK : ENTITY_ACTION.ALLOW
+```
+- 2 separate entities togehter can form dangerous property name.
 
 
 ## ignoreAttributes
@@ -1321,6 +1330,7 @@ Output
 }
 ```
 
+⚠️ You can use 'is-unsafe' library to check if doctype entities or external entities combination form any dangerous string which is not safe for your data/document.
 
 ## textNodeName
 Text value of a tag is parsed to `#text` property by default. You can always change this.
@@ -1455,6 +1465,7 @@ updateTag: (tagName, jPathOrMatcher, attrs) => {
 }
 ```
 
+> ⚠️ You should ensure that any change in tagname or attributes don't form a dangerous property.
 
 **With jPath: true (default):**
 ```js

src/xmlparser/OrderedObjParser.js

@@ -103,6 +103,7 @@ export default class OrderedObjParser {
         },
         // onExternalEntity: (name, value) => isUnsafe(value) ? 'block' : 'allow',
         onInputEntity: (name, value) =>
+          //TODO: VALID_CONTEXTS.HTML should be set only if this.options.htmlEntities
           isUnsafe(value, [VALID_CONTEXTS.HTML, VALID_CONTEXTS.XML])
             ? ENTITY_ACTION.BLOCK : ENTITY_ACTION.ALLOW,