RFC 7303 (XML Media Types) has a section "Security considerations", The last paragraph is quoted below:
Note that it is also possible to construct XML documents that make
use of what XML terms "[XML-]entity references" to construct repeated
expansions of text. Recursive expansions are prohibited by [XML] and
XML processors are required to detect them. However, even non-
recursive expansions may cause problems with the finite computing
resources of computers, if they are performed many times. For
example, consider the case where XML-entity A consists of 100 copies
of XML-entity B, which in turn consists of 100 copies of XML-entity
C, and so on.
Note that such repetitive expansion of entities does not need external parsed entities (see #2433). Internal entities can easily cause such expansion. entityExpansion.zip contains two EPUB publications containing such internal parsed entities.
One of them (IPAttackConformant.epub) conforms to EPUB 3.3. This is because 3.9 XML conformance in EPUB 3.3 does not prohibit internal parsed entities within internal DTD subsets. Meanwhile, 3.6 XML processing in EPUB 3.3 RS is silent about expansion of internal XML parsed entities. Moreover, 5.1 Validating and Non-Validating Processors in the XML recommendation requires that all conformant XML processors expand internal parsed entities declared in internal DTD subsets. Thus, EPUB 3.3 RS cannot prohibit the expansion of internal parsed entities.
The other EPUB publication in the ZIP file is derived from the first one, but its XHTML content documents contain DOCTYPE statements not allowed by 13.1.1 The DOCTYPE in WHATWG HTML.
If the repetitive expansion of entities is a problem, an easy solution is to prohibit internal DTD subsets in 3.9 XML conformance in EPUB 3.3. But this change might invalidate some existing EPUB publications.
It is worth noting that some RSes such as Thorium do not expand references to internal parsed entities. But this means that XML processing in Thorium does not conform to XML.
P.S. I should have raised this issue long time ago. I learned this issue when XML was being designed. My apology.
RFC 7303 (XML Media Types) has a section "Security considerations", The last paragraph is quoted below:
Note that such repetitive expansion of entities does not need external parsed entities (see #2433). Internal entities can easily cause such expansion. entityExpansion.zip contains two EPUB publications containing such internal parsed entities.
One of them (IPAttackConformant.epub) conforms to EPUB 3.3. This is because 3.9 XML conformance in EPUB 3.3 does not prohibit internal parsed entities within internal DTD subsets. Meanwhile, 3.6 XML processing in EPUB 3.3 RS is silent about expansion of internal XML parsed entities. Moreover, 5.1 Validating and Non-Validating Processors in the XML recommendation requires that all conformant XML processors expand internal parsed entities declared in internal DTD subsets. Thus, EPUB 3.3 RS cannot prohibit the expansion of internal parsed entities.
The other EPUB publication in the ZIP file is derived from the first one, but its XHTML content documents contain DOCTYPE statements not allowed by 13.1.1 The DOCTYPE in WHATWG HTML.
If the repetitive expansion of entities is a problem, an easy solution is to prohibit internal DTD subsets in 3.9 XML conformance in EPUB 3.3. But this change might invalidate some existing EPUB publications.
It is worth noting that some RSes such as Thorium do not expand references to internal parsed entities. But this means that XML processing in Thorium does not conform to XML.
P.S. I should have raised this issue long time ago. I learned this issue when XML was being designed. My apology.