Does disabling DTDs break internal entity deduplication?

When hardening XML parsers, many configurations recommend disabling Document Type Definitions (DTDs) entirely to prevent External Entity (XXE) vulnerabilities. However, several legacy data formats rely on internal entities for data deduplication and macro expansion within the document structure.

If the disallow-doctype-decl feature is set to true, the parser will reject any document containing a DOCTYPE, even if the entities are internal. This creates a conflict between maintaining a strict security posture and supporting functional compatibility with XML schemas that use internal entities for efficiency.

What are the specific configuration flags required to allow internal entities while strictly blocking external SYSTEM identifiers? How does the parser behave when a DTD is present but the external entity resolution feature is explicitly disabled?