v144 · security · demo

Safe XML Parser

A developer tool for auditing XML entity declarations. Write or paste any XML with <!ENTITY> declarations, click Parse XML, and inspect which entities are internal (safe), which are external (blocked in Chrome 144+), and what the parsed DOM actually contains.

⚠

Chrome 144 security fix: DOMParser no longer fetches external entities declared via SYSTEM or PUBLIC identifiers. External entity references expand to the empty string instead of triggering a network (or file system) read. Parameter entities referencing external DTDs are likewise ignored. This tool shows you exactly what a post-144 parser sees.

load an example:

DOMParser: checking…
— not parsed yet —

entity audit

Entity declarations from your XML will appear here after parsing.

parsed DOM tree

The parsed document tree will appear here after parsing.

how it works

This tool uses DOMParser.parseFromString(xml, 'text/xml') exactly as you would in production code. The entity audit panel scans your source XML with a regex to find <!ENTITY> declarations and classifies them before the parser even runs. The DOM tree panel reflects what the parser actually returned, so you can compare what was declared versus what was resolved.

const parser = new DOMParser();
const doc = parser.parseFromString(xmlString, 'text/xml');

// Chrome 144+: external SYSTEM/PUBLIC entities → empty string
// Internal entities → still expanded normally
// Parameter entities referencing external DTDs → ignored

const err = doc.querySelector('parseerror'); // present on malformed XML
const root = doc.documentElement;            // your actual content

entity type reference

declaration form type Chrome 144 behaviour
<!ENTITY name "value"> internal expanded normally — safe
<!ENTITY name SYSTEM "uri"> external SYSTEM blocked — expands to empty string
<!ENTITY name PUBLIC "id" "uri"> external PUBLIC blocked — expands to empty string
<!ENTITY % name SYSTEM "uri"> parameter (external) blocked — DTD not fetched
<!ENTITY % name "value"> parameter (internal) may expand within DTD subset

see also