code: public static function xml($response)
      {
          $body = self::toString($response);
          $errorMessage = null;
          $internalErrors = libxml_use_internal_errors(true);
          $disableEntities = libxml_disable_entity_loader(true);
          libxml_clear_errors();
          $xml = null;
          try {
              $xml = new \SimpleXMLElement((string) $body ?: /** @lang text */
                  '<root />', LIBXML_NONET);
          } catch (\Exception $e) {
              $errorMessage = $e->getMessage();
          }
          libxml_clear_errors();
          libxml_use_internal_errors($internalErrors);
          libxml_disable_entity_loader($disableEntities);
          if ($errorMessage !== null) {
              throw new RuntimeException('Unable to parse response body into XML: ' . $errorMessage);
          }
          return $xml;
      }
docs: Parse the XML response body and return a \SimpleXMLElement.
  
  In order to prevent XXE attacks, this method disables loading external
  entities. If you rely on external entities, then you must parse the
  XML response manually by accessing the response body directly.
  
  Copied from Response->xml() in Guzzle3 (copyright @mtdowling)
  @link https://github.com/guzzle/guzzle3/blob/v3.9.3/src/Guzzle/Http/Message/Response.php
  
  @param  string|ResponseInterface $response
  @return \SimpleXMLElement
  @throws RuntimeException if the response body is not in XML format
  @link http://websec.io/2012/08/27/Preventing-XXE-in-PHP.html