|
I know it sounds silly, but html and xml allowed people to craft their own entity definitions and people actually crafted recursive entities that were used to attack websites and browsers. There is actually a lot of code to prevent evilly crafted named entities. The move to just numeric entities has made validating and expanding entities much easier and safer and help to restrict attack vectors.
|