XML External Entity Vulnerability DoS case: when the expansion happens?

Question

I am working on an app which takes XML file as input and then processes it. We found out that the app is vulnerable to XXE DoS attack, namely famous Billion Laughs case. Before the file is processed, it is validated against schema. So, my question is, will the DoS attack take place during the validation? Or during the validation the XML entities are not expanded and hence the DoS attack will happen only after validation, when validated file is parsed?

Answer 1

Basically, a parser MUST expand entities to validate a document (see 4.4.3 in XML recommendation), since your entities may include some markup, and build up a valid document.

So yes, the problem may occur during validation of the XML file.