Thank you, Martin.

Is this accurate:

SAXON has a configuration property allowedProtocols that can be set to
"https,http" to allow only HTTPS and HTTP URIs to be resolved, while file URI
access should fail. However, currently, when doing this:

   unparsed-text('file:///Windows/win.ini')

SAXON fails to block the parsing of the XML.