The Decline of XML Unparsed Entities and Notations

Early XML specifications included unparsed entities and notations to handle external, non-XML data formats by borrowing mechanisms directly from SGML. However, modern software architectures have virtually abandoned these features due to their reliance on Document Type Definitions (DTDs), severe security vulnerabilities like XML External Entity (XXE) attacks, and the emergence of simpler alternatives such as MIME types, direct URI linking, and modern schema languages.

Legacy from SGML

Unparsed entities and notations were inherited from SGML to reference binary resources—such as images, audio files, or proprietary data formats—within a document. A notation declared the format or helper application required to process the data, while an unparsed entity bound a specific external resource to that notation. In the early days of structured text, this provided a standardized way to declare external resource types before web-native protocols became ubiquitous.

Tight Coupling to DTDs

The primary technical limitation of unparsed entities and notations is their strict dependency on DTDs. As XML evolved, the software industry moved away from DTDs toward namespace-aware and strongly typed schema languages such as W3C XML Schema (XSD) and RELAX NG. Because unparsed entities cannot be natively defined or managed within these modern schema systems without legacy DTD wrappers, architects stopped using them in favor of standard XML elements and attributes.

Redundancy with Web Standards and HTTP

The rise of the World Wide Web established better, decentralized mechanisms for identifying and typing resources: * Uniform Resource Identifiers (URIs): Standard attributes (such as href or src) containing URIs made referencing external resources intuitive and standard across formats like XHTML. * MIME Types: Transport protocols, particularly HTTP, handle content negotiation and format identification natively using the Content-Type header, rendering XML-level notation declarations redundant. * Inline Encoding: When embedding binary data directly inside XML became necessary, Base64 encoding inside standard text nodes proved simpler and more portable across modern API pipelines.

Security Vulnerabilities

Entity processing has historically been one of the most exploited attack surfaces in XML parsers. Enabling external entity resolution exposes applications to XML External Entity (XXE) injection, Server-Side Request Forgery (SSRF), and denial-of-service vulnerabilities (such as the Billion Laughs attack). To secure modern systems, current best practices mandate disabling external DTD and entity parsing entirely, effectively eliminating support for unparsed entities in production environments.

Parser Complexity and Maintenance

Supporting notations and unparsed entities requires XML parsers to maintain state machines for external catalog lookups and non-XML resource handlers. Modern data pipelines favor lightweight, fast, and memory-efficient parsers. Removing the need to resolve entity declarations streamlined parser implementations and aligned XML processing with lightweight architectures like REST and microservices.