Comment 5 for bug 1234114

BTW, I do not consider this a security concern or critical issue. It's not a common use case to run validations with schemas that come themselves from untrusted sources, and external imports should always be covered by catalogues (otherwise, that's a configuration problem on the user side). So it's more of an inconvenience and it would help to have an error message that makes users aware of the problem.