XML - XML Catalogs and Public Identifier Resolution

 

1. Introduction

XML Catalogs and Public Identifier Resolution are important concepts in XML document management. They help XML processors locate external resources such as Document Type Definitions (DTDs), XML schemas, and other documents referenced within an XML file.

An XML document may depend on external resources to define its structure or provide additional information. For example, an XML document can refer to a DTD stored on a remote server. Whenever the document is processed, the XML processor may attempt to access that resource through the internet. This can cause delays, network dependency, or processing failures if the server is unavailable.

XML Catalogs provide a solution by mapping external identifiers and resource references to alternative locations, often local files. This allows XML processors to resolve references without always retrieving resources from their original online locations.

2. What Is an XML Catalog?

An XML Catalog is a configuration file that tells an XML processor where to find a resource associated with a particular identifier or URI.

Instead of downloading an external resource every time it is required, the processor can consult the catalog and locate a corresponding local copy.

For example, suppose an XML document references a DTD hosted at:

https://example.com/dtd/library.dtd

An XML Catalog can map this URI to a local file:

file:///project/dtd/library.dtd

When the XML processor encounters the original reference, it can use the catalog mapping to locate the local DTD instead of accessing the remote server.

XML Catalogs are particularly useful in software development environments where documents must be processed repeatedly and consistently.

3. What Is Public Identifier Resolution?

Public Identifier Resolution is the process of identifying an external resource using a public identifier and locating the resource associated with that identifier.

In XML, a DTD can be referenced using a public identifier, a system identifier, or both.

A public identifier is a formal name assigned to identify an external resource. A system identifier usually specifies a URI or location from which the resource can be retrieved.

Consider the following XML declaration:

<!DOCTYPE library PUBLIC
  "-//Example Organization//DTD Library 1.0//EN"
  "https://example.com/dtd/library.dtd">

In this example:

  • -//Example Organization//DTD Library 1.0//EN is the public identifier.

  • https://example.com/dtd/library.dtd is the system identifier.

The XML processor can use either identifier, depending on its configuration and resolution rules, to locate the required DTD. If an appropriate catalog entry exists, the processor may resolve the identifier to a local resource.

Public identifiers are useful when a resource needs a recognizable name that is independent of a particular server location.

4. How XML Catalogs Work

XML Catalog resolution generally follows a sequence of steps.

Step 1: An XML document references an external resource.

The document may reference a DTD, schema, or another external resource through a URI or public identifier.

Step 2: The XML processor encounters the reference.

While parsing the document, the processor determines that it needs to locate the referenced resource.

Step 3: The processor checks the configured catalog.

If catalog resolution is enabled and the catalog contains a matching entry, the processor uses that mapping.

Step 4: The resource is located.

The mapping may point to a local file or another approved location. The processor then obtains the resource from that location.

Step 5: The document is processed.

The processor uses the retrieved resource for the relevant operation, such as DTD-based validation or document processing.

If no catalog entry matches, the processor may fall back to the original system identifier, depending on its configuration. This is why catalog configuration and external-resource access policies are important.

5. Example of an XML Catalog

Consider an XML document that references a DTD using a public identifier:

<!DOCTYPE library PUBLIC
  "-//Example Organization//DTD Library 1.0//EN"
  "https://example.com/dtd/library.dtd">

<library>
    <book>
        <title>Introduction to XML</title>
        <author>John Smith</author>
    </book>
</library>

Suppose the DTD is already available locally at:

/project/dtd/library.dtd

An XML Catalog can associate the public identifier with the local file.

A simplified OASIS XML Catalog example is shown below:

<?xml version="1.0" encoding="UTF-8"?>

<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">

    <public
        publicId="-//Example Organization//DTD Library 1.0//EN"
        uri="file:///project/dtd/library.dtd"/>

</catalog>

In this example, the public entry maps the public identifier to the local DTD.

When an XML processor is configured to use this catalog, it can resolve the public identifier to the local resource. The mapping helps avoid unnecessary dependence on the remote DTD location.

The catalog does not itself define the structure of the library document. The DTD defines the permitted document structure, while the catalog helps the processor find that DTD.

6. Types of XML Catalog Entries

XML Catalogs support several entry types for resolving different kinds of references.

Public entries

A public entry maps a public identifier to a resource URI. It is commonly used when an external DTD is identified by a formal public name.

System entries

A system entry maps a system identifier, such as an external URI, to an alternative URI.

For example:

<system
    systemId="https://example.com/dtd/library.dtd"
    uri="file:///project/dtd/library.dtd"/>

This tells the processor to use the local DTD when the specified system identifier is encountered.

URI entries

A uri entry maps a URI reference to another URI. It is useful for resolving external resources identified directly by URI references.

<uri
    name="https://example.com/schemas/library.xsd"
    uri="file:///project/schemas/library.xsd"/>

The exact behavior depends on the processor and the type of reference being resolved.

7. Advantages of XML Catalogs and Public Identifier Resolution

XML Catalogs offer several practical advantages.

Reduced network dependency: Local mappings allow XML processors to access resources without repeatedly contacting remote servers.

Improved processing speed: Resources stored locally can often be retrieved faster than resources downloaded over a network.

Greater reliability: XML processing can continue even when an external server is temporarily unavailable, provided the required resource is available locally.

Consistent development environments: Teams can configure processors to use the same approved versions of external DTDs and other resources.

Centralized resource management: Catalog files provide a convenient way to manage mappings for many XML documents from one configuration.

Better control over resource locations: Organizations can direct resource references to approved local copies rather than allowing unrestricted retrieval from external locations.

8. Security Considerations

Although XML Catalogs can improve resource management, they must be configured carefully.

An XML processor that retrieves external resources without appropriate restrictions may expose an application to security risks, including XML External Entity (XXE) attacks, unauthorized file access, or unintended network requests.

A catalog can help direct resource resolution to trusted locations, but it is not a complete security mechanism by itself.

To improve security, developers should:

  • Disable external entity processing when it is not required.

  • Restrict access to external network resources.

  • Use trusted catalog files and approved local resources.

  • Prevent untrusted XML documents from triggering arbitrary file or network access.

  • Configure the XML processor to reject unexpected external references.

  • Keep local DTDs and schemas under controlled version management.

The security settings of the XML processor remain essential, even when a catalog is available.

9. Practical Applications

XML Catalogs and Public Identifier Resolution are useful in several real-world situations.

Software development: Developers can maintain local copies of DTDs and schemas required by XML-based applications.

Enterprise document management: Organizations can process large collections of XML documents using standardized resource mappings.

Offline XML processing: Applications can validate documents in environments where internet access is restricted or unavailable.

Technical documentation: Documentation systems that use XML formats can resolve shared DTDs and other resources from controlled local locations.

Build and testing systems: Automated build pipelines can use catalog mappings to reduce network dependency and improve the reproducibility of XML processing.

10. Conclusion

XML Catalogs and Public Identifier Resolution provide a structured way to locate external resources referenced by XML documents. Public identifiers offer formal names for identifying resources, while system identifiers commonly specify their locations. XML Catalogs connect these identifiers or URIs to alternative resource locations, including local files.

By using catalogs, developers can reduce unnecessary network requests, improve processing reliability, manage resource versions, and maintain consistent XML environments. However, catalog configuration should be combined with appropriate XML processor security settings to prevent unsafe external resource access.

A clear understanding of this topic helps XML developers build applications that process external XML resources more efficiently, reliably, and securely.