Skip to main content
XMLDir

Search 309 pages — tools, formats, elements, namespaces, directory, comparisons, XPath, datatypes, glossary, parse errors, schema errors, use cases, blog and product.

Document syntax

External entity

An entity whose replacement text lives outside the document, named by a SYSTEM or PUBLIC identifier and fetched when the entity is referenced.

The specification permits an entity to be declared as a pointer — a file path or a URL — rather than as literal text. A parser that honours the declaration fetches the resource and splices its contents into the document at the point of reference.

That is a remote fetch triggered by the document's own content, which is exactly the shape of a server-side request forgery. Modern practice is to refuse it, and our pipeline does: the document is read for well-formedness, but no external resource is fetched and no structure is built from one.

Defined in
XML 1.0 §4.2.2
Category
Document syntax
Also written
SYSTEM entity, external general entity

Shown, not asserted

All 2 claims are executed on every test run, against the same engines the tools use. If the behaviour changes, the test fails rather than this page quietly becoming wrong.

  • Our pipeline never resolves an external entity — it says so instead of fetching.

    document.xml
    <!DOCTYPE x [<!ENTITY secret SYSTEM "file:///etc/hostname">]>
    <x>&secret;</x>

    What the engine returns

    Well-formed. The document is well-formed, but its structure could not be extracted: External entities are not supported
  • An external DTD is likewise pointed at and not fetched.

    document.xml
    <!DOCTYPE x SYSTEM "https://example.com/x.dtd">
    <x>hi</x>

    What the engine returns

    Well-formed.

What catches people out

  • A document that relies on external entities is read differently by every consumer, because whether they are fetched is a parser setting rather than a document property.
  • "Not supported" and "fetched and failed" look identical from the outside. Never treat an empty expansion as proof that nothing was requested.
  • A PUBLIC identifier still carries a SYSTEM fallback, so declaring one is not safer.

Get started

Bring order to the XML your team can't afford to ignore.

Create a free account and get a private workspace to search, validate, diff, and monitor your XML feeds, sitemaps, schemas, and vendor integrations.