Add internal parameter entities (parsed, stored, and expanded within the DTD, including bare %name; references that inject markup declarations, bounded by depth and the expansion budget). Record external general entities and the external subset identifier, and load them only through an injected EntityResolver (a struct of closures). The default refusing resolver fetches nothing, so XXE stays closed: an external entity fails as undefined and the external subset is left unread. Internal declarations win over the external subset. Closes #29 |
||
|---|---|---|
| .. | ||
| Emitting | ||
| Model | ||
| Parsing | ||
| Stream | ||
| Validation | ||
| XPath | ||
| API.swift | ||
| PureXML.swift | ||