Exactly. If you do want to encode control characters, the way to do that would be as character entities (which are simply text like &) and handle the translation of these entities at the application level. As an example, if we want a newline to be removed for presentation (or translated into a newline symbol like in Microsoft Word), the right place to do that would be at the rendering time and not in the data representation layer (which is where XML operates).

You could also use tags, for example <br> tag in HTML.

After all it is Extensible Markup Language and the functionality for adding custom tags is the basic feature.

And as suggested above, base64 encoding and application level decoding is also an accepted practice.

All these techniques point to handling the rendering at the application level.