Fix prototype pollution vulnerability

[yadhukrishnam]

Set the prototype of parsed xml object to undefined, so that prototype pollution is prevented.

[fiznool]

Do we need to sanitize nested objects as well? What about an XML payload of (e.g.)

<foo>
  <bar>
    <__proto__>
      <name>Bob</name>
    </__proto__>
  </bar>
</foo>

From what I can gather about prototype pollution, it can happen if __proto__ is overridden on any object?

[fiznool]

Do we need to sanitize nested objects as well?

Did you have any thoughts on this?

[yadhukrishnam]

Do we need to sanitize nested objects as well?

Did you have any thoughts on this?

I tested that. But doesn't seem to be vulnerable. The fix seems perfect for me now.

[fiznool]

CI is failing: need to run npm run prettier to fix. Once this is done and CI is passing I will merge in.

[fiznool]

Thank you for the contribution, released as 2.0.3