DTD Validator

// npm i libxml2-wasm, the same engine this page runs.
import { XmlDocument, ParseOption } from 'libxml2-wasm';

// DTDVALID turns validation on. NO_XXE keeps the external subset and any
// external entities unresolved, which is what makes this safe on input you
// did not write.
const OPTS =
  ParseOption.XML_PARSE_DTDVALID |
  ParseOption.XML_PARSE_NO_XXE |
  ParseOption.XML_PARSE_NONET;

export function validateDtd(xmlText, dtdText) {
  // A separately supplied DTD is spliced in as an internal subset rather than
  // loaded, exactly as this page does it.
  let source = xmlText;
  if (dtdText) {
    const root = xmlText.match(/<([A-Za-z_:][\w.\-:]*)[\s>/]/)?.[1] ?? 'root';
    const stripped = xmlText.replace(/<!DOCTYPE[^[>]*(\[[\s\S]*?\])?\s*>/, '');
    source = `<!DOCTYPE ${root} [\n${dtdText}\n]>\n${stripped.trimStart()}`;
  }

  let doc = null;
  try {
    doc = XmlDocument.fromString(source, { option: OPTS });
    return { valid: true, errors: [] };
  } catch (err) {
    // libxml2 reports a broken document and a document that does not follow
    // the DTD through the same exception. details is [{ line, col, message }].
    const details = err?.details ?? [{ message: String(err?.message ?? err) }];
    return { valid: false, errors: details };
  } finally {
    doc?.dispose();
  }
}

# pip install lxml
from io import StringIO
from lxml import etree

parser = etree.XMLParser(
    resolve_entities=False,   # do not expand entities from the DOCTYPE
    no_network=True,          # never fetch an external subset
    huge_tree=False,          # keep the depth and amplification limits
)

doc = etree.parse('article.xml', parser)

# A DTD held separately: validate without touching the document's own prolog.
with open('article.dtd', encoding='utf-8') as fh:
    dtd = etree.DTD(StringIO(fh.read()))

if dtd.validate(doc):
    print('valid')
else:
    for e in dtd.error_log.filter_from_errors():
        print(f'{e.line}:{e.column} {e.message}')

# To validate against an internal subset instead, parse with dtd_validation=True
# and read parser.error_log:
#   etree.XMLParser(dtd_validation=True, no_network=True, resolve_entities=False)

import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import org.xml.sax.InputSource;
import org.xml.sax.SAXParseException;
import org.xml.sax.helpers.DefaultHandler;
import java.io.StringReader;

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setValidating(true);          // DTD validation on
factory.setNamespaceAware(true);
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);

// disallow-doctype-decl CANNOT be used here: it would reject the DOCTYPE you
// are trying to validate against. Block the fetch, not the declaration.
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

DocumentBuilder builder = factory.newDocumentBuilder();

// Supply the DTD text yourself instead of letting the parser go and find it.
builder.setEntityResolver((publicId, systemId) ->
    new InputSource(new StringReader(dtdText)));

builder.setErrorHandler(new DefaultHandler() {
    @Override public void error(SAXParseException e) {
        System.out.printf("%d:%d %s%n", e.getLineNumber(), e.getColumnNumber(), e.getMessage());
    }
});

builder.parse(new InputSource(new StringReader(xmlText)));

using System;
using System.Xml;

var settings = new XmlReaderSettings
{
    // Parse, not Prohibit: DTD validation needs the DOCTYPE read.
    DtdProcessing = DtdProcessing.Parse,
    ValidationType = ValidationType.DTD,

    // A null resolver is what stops an external subset or entity being
    // fetched. This is the single most important line here.
    XmlResolver = null,

    MaxCharactersFromEntities = 1024 * 1024,
    MaxCharactersInDocument = 20L * 1024 * 1024,
};

settings.ValidationEventHandler += (_, e) =>
    Console.WriteLine($"{e.Exception.LineNumber}:{e.Exception.LinePosition} {e.Message}");

using var reader = XmlReader.Create("article.xml", settings);
while (reader.Read()) { }   // errors arrive through the handler as it reads

// With XmlResolver = null, a document whose DTD lives in a separate file will
// report that no DTD was found. Inline the declarations into the DOCTYPE first.

<?php
// LIBXML_DTDVALID validates against the DOCTYPE. LIBXML_NONET blocks the fetch.
libxml_use_internal_errors(true);

$doc = new DOMDocument();
$loaded = $doc->loadXML($source, LIBXML_DTDVALID | LIBXML_NONET);

foreach (libxml_get_errors() as $e) {
    // level 1 is a warning, 2 an error, 3 fatal.
    fprintf(STDERR, "%d:%d %s\n", $e->line, $e->column, trim($e->message));
}
libxml_clear_errors();

if (!$loaded) {
    exit(1);
}

// DOMDocument::validate() runs the same check on an already-parsed document,
// which is useful when you want the tree even if it turns out to be invalid.

# Validate against the document's own internal subset or DOCTYPE:
xmllint --noout --nonet --valid article.xml

# Validate against a DTD held separately, ignoring any DOCTYPE in the file.
# This is the form for JATS, DocBook and other modular DTDs: xmllint resolves
# the .ent modules from disk, which a browser cannot do.
xmllint --noout --nonet --dtdvalid JATS-journalpublishing1.dtd article.xml

# Exit status is 0 when the document is valid. --nonet is not the default, and
# without it xmllint will happily fetch a DTD over HTTP.