3.8.3 Items that can be restricted

(a) Number of times an entity reference is expanded

The number of times an entity reference is expanded can be limited. If a violation of this restriction occurs during XML parsing, a KECX01225-E error is reported as an error notification (fatalError event) or exception.

The following shows an example of XML code subject to the restriction on the maximum number of times an entity reference is expanded.

<!DOCTYPE root [
 <!ENTITY x3 "abc">
 <!ENTITY x2 "&x3;&x3;">
 <!ENTITY x1 "&x2;&x2;">
 ]>
<root>&x1;</root>

In the preceding example, the number of times an entity reference is expanded is seven (&x1; &x2; &x3; &x3; &x2; &x3; &x3;).

(b) String length of a general entity

The string length of a general entity can be limited. If a violation of this restriction occurs during XML parsing, a KECX01232-E error is reported as an error notification (fatalError event) or exception.

The following shows an example of XML code subject to the restriction on the maximum string length of a general entity.

<!DOCTYPE root [
 <!ENTITY GE4 "hijk">
 <!ENTITY GE3 "abcd">
 <!ENTITY GE2 "efgh&GE3;ijk">
 <!ENTITY GE1 "lmn">
 ]>
<root>&GE1;&GE2;</root>

In the preceding example, the functionality performs a length check on GE1 and GE2, which reference entities. For entity GE1, the length of the string lmn (3 characters) is checked. For entity GE2, the length of the string efghabcdijk (11 characters), which results from expansion of GE3, is checked. The length of GE3 itself is not checked. No length check is performed on GE4, for which no entity reference occurs.

(c) String length of a parameter entity

The length of a parameter entity after expansion can be limited. If a violation of this restriction occurs during XML parsing, a KECX01232-E error is reported as an error notification (fatalError event) or exception.

The following shows an example of XML code subject to the restriction on the maximum string length of a parameter entity.

<!ENTITY % PE2 "abcd">
<!ENTITY % PE1 "%PE2;efgh">
<!ENTITY GE1 "ij">
<!ENTITY % PEG1 "&GE1;klmn">
<!ENTITY % PEEXT SYSTEM "ext.xml">

In the preceding example, the functionality performs length checks as follows: For parameter entity PE1, the length of the string abcdefgh (8 characters), which results from expansion of parameter entity PE2, is checked. For parameter entity PE2, the length of the string abcd (4 characters) is checked. For PEG1, which is a parameter entity that references general entity GE1, the length of the string &GE1;klmn (9 characters) is checked. This is because a general entity referenced by a parameter entity is not expanded. No length check is performed on PEEXT, which is an external parameter entity that is not referenced.

(d) Total string length of expanded general entities and parameter entities

The total length of expanded general entities and parameter entities can be limited. If a violation of this restriction occurs during XML parsing, a KECX01233-E error is reported as an error notification (fatalError event) or exception.

The following shows an example of XML code subject to the restriction on the total length of expanded general entities and parameter entities.

<!ENTITY GE3 "abcd">
<!ENTITY GE2 "efgh&GE3;ijk">
<!ENTITY GE1 "lmn">
<!ENTITY % PE2 "abcd">
<!ENTITY % PE1 "%PE2;efgh">

In the preceding example, if only general entities GE1 and GE2 are referenced, the total length of the expansion results of GE1 and GE2 (referenced general entities) and PE1 and PE2 (defined parameter entities) is 26 as follows:

• GE1: lmn (number of characters: 3)

• GE2: efghabcdijk (number of characters: 11)

• PE1: abcdefgh (number of characters: 8)

• PE2: abcd (number of characters: 4)