QXmlStreamEntityResolver Class

Detailed Description

Use to inform QXmlStreamReader how to expand entities not declared in the internal-set of the DTD.

Security Considerations

Entity Cycles

You must take care to avoid resolving entities in cycles, because QXmlStreamReader only detects and rejects cycles in entities defined in the DTD, not in entities expanded from an implementation of the QXmlStreamEntityResolver interface.

This is by design: QXmlStreamReader puts the work on the implementation of a concrete QXmlStreamEntityResolver. For static mappings, like XML Entity Definitions for Characters, this is trivially guaranteed, so running some tracking in the background would just slow things down for everyone.

Things get interesting when you read entity definitions from external input, including untrusted sources. In this case, your implementation must ensure the expansions it uses as input are cycle-free. This is a simple graph operation that can be implemented in linear time and space and can be performed up front at load time, so it doesn't affect resolveUndeclaredEntity() performance.

Entity Expansion Limit

At the moment, entities resolved by this class do not count against QXmlStreamReader::entityExpansionLimit(). This may change in future versions of Qt.

For the time being, you need to enforce some upper expansion limit yourself, if you read entity definitions from external input. After cycle detection, longest-path calculation is a simple graph operation that can be implemented in linear time and space and can be performed up front at load time, so it, too, doesn't affect resolveUndeclaredEntity() performance.