[loeg]

I agree in general. But XML as used in plists is actually not especially complicated, if you aren't trying to be a webbrowser and tolerate invalid input.

Your security-sensitive parser should not attempt to tolerate invalid input.

Probably you should not have multiple separate implementations of it, either.