Intent to Deprecate and Remove: Externally loaded entities in XML parsing

62 views

Skip to first unread message

Dominik Röttsches

unread,

Oct 31, 2025, 11:04:23 AM (3 days ago) Oct 31

to blink-dev

Explainer
No information provided

Specification
https://www.w3.org/TR/xml/#proc-types

Summary
Chrome synchronously fetches external XML entities/DTDs and incorporates them into parsing under specific circumstances. I propose to remove this functionality.

Test case xml-external-entity.xml gives an example:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"
[
<!ENTITY entity_application_xml_external_parsed_entity SYSTEM "http://127.0.0.1:8000/security/contentTypeOptions/resources/script-with-header.pl?mime=application/xml-external-parsed-entity">
...

External entities can be defined in the trailing part of the DOCTYPE statement - and then refer to resources that are to be synchronously loaded and included as context when parsing XML.

Another syntax example would be a DOCTYPE that, using the SYSTEM keyword followed by a URL pointing to a DTD which contains additional entity definitions.

Such external load requests are passed up from the parser and allowed only if they are a same origin request and the response mimetype matches: application/xml-external-parsed-entity.

According to https://www.w3.org/TR/xml/#proc-types non-validating processor are not required to read external entities.

Blink component
DOM

Web Feature ID
Falls under XML feature group, but did not see a specific parsing feature.

Motivation
The usage has continuously decreased and is at an extremely low level of 0.000015, compare: https://chromestatus.com/metrics/feature/timeline/popularity/529 We intend to improve the security of XML parsing in Chrome. (See internal go/chrome_x_mitigation).

In this effort, we intend to replace libxml2 as the XML parser with an XML parser written in Rust (crate "xml"). The Rust-based XML parser we intend to migrate to, does not support external entities and we don't think it's necessary or desirable to implement this feature.

Synchronous loads during parsing are considered inefficient, and can be avoided by inlining the needed entity definitions.

As usage is so low, Firefox never supported this, I propose to deprecate in 144, and remove in 145.

Initial public proposal
No information provided

Debuggability
Parsing success/failure is debuggable, same as before.

Requires code in //chrome?
No

Tracking bug
https://crbug.com/455813733

Estimated milestones

Starting deprecation in 144

Shipping on desktop 144
Shipping on Android 144
Shipping on WebView 144

Link to entry on the Chrome Platform Status
https://chromestatus.com/feature/6734457763659776?gate=4825690713227264

This intent message was generated by Chrome Platform Status.

Reply all

Reply to author

Forward

0 new messages