Document syntax
External entity
An entity whose replacement text lives outside the document, named by a SYSTEM or PUBLIC identifier and fetched when the entity is referenced.
The specification permits an entity to be declared as a pointer — a file path or a URL — rather than as literal text. A parser that honours the declaration fetches the resource and splices its contents into the document at the point of reference.
That is a remote fetch triggered by the document's own content, which is exactly the shape of a server-side request forgery. Modern practice is to refuse it, and our pipeline does: the document is read for well-formedness, but no external resource is fetched and no structure is built from one.
- Defined in
- XML 1.0 §4.2.2
- Category
- Document syntax
- Also written
- SYSTEM entity, external general entity
Shown, not asserted
All 2 claims are executed on every test run, against the same engines the tools use. If the behaviour changes, the test fails rather than this page quietly becoming wrong.
Our pipeline never resolves an external entity — it says so instead of fetching.
document.xml <!DOCTYPE x [<!ENTITY secret SYSTEM "file:///etc/hostname">]> <x>&secret;</x>What the engine returns
Well-formed. The document is well-formed, but its structure could not be extracted: External entities are not supportedAn external DTD is likewise pointed at and not fetched.
document.xml <!DOCTYPE x SYSTEM "https://example.com/x.dtd"> <x>hi</x>What the engine returns
Well-formed.
What catches people out
- A document that relies on external entities is read differently by every consumer, because whether they are fetched is a parser setting rather than a document property.
- "Not supported" and "fetched and failed" look identical from the outside. Never treat an empty expansion as proof that nothing was requested.
- A PUBLIC identifier still carries a SYSTEM fallback, so declaring one is not safer.
Where it bites
A definition on its own is trivia. These are the pages where this term decides whether a document works.
Related terms
- General entityAn entity declared with <!ENTITY name "text"> whose replacement text is substituted wherever &name; appears in content.
- Parameter entityAn entity declared with <!ENTITY % name "…"> and referenced as %name;, usable only inside markup declarations rather than in document content.
- Document type declarationThe <!DOCTYPE root …> in the prolog that names the document's root element and points at, or contains, its markup declarations.
- XXE (XML external entity attack)An attack in which a submitted document declares an external entity so that a trusting parser reads a local file or makes a request on the attacker's behalf.
Get started
Bring order to the XML your team can't afford to ignore.
Create a free account and get a private workspace to search, validate, diff, and monitor your XML feeds, sitemaps, schemas, and vendor integrations.