Should "external identifiers" be "external entities"?

[dlazin]

https://www.w3.org/TR/epub-rs-33/#confreq-rs-xml-extid says:

when processing XML documents, it MUST NOT resolve external identifiers [XML].

But the link, to https://www.w3.org/TR/2008/REC-xml-20081126/#NT-ExternalID, refers to "external entities." Are these the same thing? Were they renamed in the XML spec? "External identifiers" does appear a few times in the linked doc, but not many.

I'm guessing that the identifier is the thing that refers to the entity, and the entity is the target itself, so not resolving identifiers is perhaps correct, but best to check and perhaps (?) to rephrase.

[dauwhe]

I'm wondering what the purpose of this restriction is.

It's an extreme example, but what if you had an EPUB with docbook falling back to HTML. It would be really common to have:

<!ENTITY ch01 SYSTEM "ch01.sgm">
<!ENTITY ch02 SYSTEM "ch02.sgm">
<!ENTITY ch03 SYSTEM "ch03.sgm">
<!ENTITY ch04 SYSTEM "ch04.sgm">

<book>
&ch01;
&ch02;
&ch03;
&ch04;
</book>

and in EPUB have <item href="book.xml" media-type="application/xml" fallback="book-html"/>

What harm are we preventing here? Do the commonly-used XML files in EPUB like container and package allow external entities anyway?

[mattgarrish]

External identifier is only defined once as the ExternalID notation that is linked to (the XML spec reuses its definitions). So even though it appears under external entities, all references to external identifiers in the spec link to that notational description.

Why we have it goes back to #1338 and #1368 when we were discussing allowing the SVG doctype by pushing the requirement to ignore external identifiers onto reading systems, since that's where the security issue is.

The same ExternalID reference is used in the definition for doctypes. It would also ban external identifiers in notations.

If we ban external identifiers completely, as we did before, we disallow the doctypes again.

[mattgarrish]

What if we add the three affected syntaxes to the end:

when processing XML documents, it MUST NOT resolve external identifiers in DOCTYPE, ENTITY and NOTATION declarations [XML].

I don't see how else we could easily work around this quirk of the XML spec.