XML data is loaded using SAML2_DOMDocumentFactory class

lib/SimpleSAML/Bindings/Shib13/Artifact.php

lib/SimpleSAML/Bindings/Shib13/HTTPPost.php

lib/SimpleSAML/Metadata/SAMLParser.php

lib/SimpleSAML/Metadata/Signer.php

lib/SimpleSAML/Utils/XML.php

lib/SimpleSAML/XML/Shib13/AuthnResponse.php

modules/adfs/lib/IdP/ADFS.php

modules/adfs/lib/XMLSecurityDSig.php

modules/cas/lib/Auth/Source/CAS.php

modules/core/lib/Auth/Process/TargetedID.php

modules/metarefresh/lib/MetaLoader.php

modules/saml/docs/sp.txt

...les/saml/lib/Auth/Process/PersistentNameID2TargetedID.php

modules/saml/lib/IdP/SAML2.php

www/saml2/idp/ArtifactResolutionService.php