XML external entity risk and local entity-expansion denial of service are related parser-boundary problems, but they are not the same finding. An external SYSTEM or PUBLIC entity can become a file-disclosure or server-side request risk only when the receiving parser is configured to resolve it.
A document can also define only local entities whose replacement text recursively multiplies. tryb builds a bounded dependency graph and reports a saturated static projection when locally available declarations exceed its policy threshold; that projection is not measured parser memory usage and does not prove a specific runtime will expand the document.
This analyzer never fetches an entity URI, processes an external DTD, or invokes a parser with entity expansion enabled. Browser and client parsers may reject or ignore DTDs differently, so confirm the actual server-side parser configuration before deciding impact.
Edge cases worth knowing
- An external entity in a rejected DTD
- The declaration is still observable, but exploitability depends on a downstream parser accepting the DTD and resolving external entities.
- A compact recursive entity graph
- A short document can project to a large replacement through repeated references. tryb uses saturated arithmetic and strict graph bounds rather than performing expansion.
- A cyclic declaration
- Cycles are reported separately and traversal stops. The result does not predict the exact error or resource behavior of a named XML library.
Common mistakes
- Calling every DOCTYPE a proven XXE vulnerability without checking parser configuration.
- Fetching a SYSTEM identifier during security inspection.
- Treating projected replacement characters as measured heap allocation.
- Assuming browser XML behavior matches a server-side parser or framework.