Does disabling DTDs break internal entity deduplication?

Question

When hardening XML parsers, many configurations recommend disabling Document Type Definitions (DTDs) entirely to prevent External Entity (XXE) vulnerabilities. However, several legacy data formats rely on internal entities for data deduplication and macro expansion within the document structure.
If the disallow-doctype-decl feature is set to true, the parser will reject any document containing a DOCTYPE, even if the entities are internal. This creates a conflict between maintaining a strict security posture and supporting functional compatibility with XML schemas that use internal entities for efficiency.
What are the specific configuration flags required to allow internal entities while strictly blocking external SYSTEM identifiers? How does the parser behave when a DTD is present but the external entity resolution feature is explicitly disabled?

Tasadduq Burney · Answer

Yes, disabling DTDs entirely via the disallow-doctype-decl feature breaks internal entity deduplication. This is because internal entities are defined within the  block. If the parser is configured to reject the DOCTYPE entirely, it terminates document processing immediately upon encountering the declaration, before it can map or expand the internal entities used for data deduplication.

Balancing Security and Functionality
To support legacy formats that rely on internal entities while preventing External Entity (XXE) attacks, you must move away from a "block all" DTD strategy to a granular restriction model. This allows the parser to process the internal DTD subset while forbidding external references.

Required Configuration Flags
In standard XML-compliant parsers (such as Xerces in Java), the following configuration is required to allow internal entities while strictly blocking external identifiers:

disallow-doctype-decl: Set to false. This allows the DOCTYPE declaration to be processed.
  external-general-entities: Set to false. This prevents the resolution of SYSTEM/PUBLIC general entities.
  external-parameter-entities: Set to false. This prevents the resolution of entities used within the DTD itself.

Parser Behavior Analysis
When a DTD is present but external entity resolution is explicitly disabled, the parser behaves as follows:

The parser validates the internal DTD subset and stores internal entity definitions (macros) in memory.
  When it encounters an internal entity reference in the XML body, it replaces it with the defined value (achieving the deduplication/expansion goal).
  If the parser encounters a SYSTEM or PUBLIC identifier, it will throw an error or return an empty string (depending on the specific implementation), preventing the external network request.

Note: While this configuration protects against XXE, it may leave the application vulnerable to "Billion Laughs" style Denial of Service (DoS) attacks. It is recommended to set entity expansion limits to mitigate this risk.

Does disabling DTDs break internal entity deduplication?

1 answer

Balancing Security and Functionality

Required Configuration Flags

Parser Behavior Analysis

Your perspective belongs here.

0 question comments