Use XmlReader for Deserialize
Use XmlReader for Deserialize
Microsoft docsDescription
Processing untrusted DTD and XML schemas may enable loading dangerous external references, which should be restricted by using an XmlReader with a secure resolver or with DTD and XML inline schema processing disabled. This rule detects code that uses the System.Xml.Serialization.XmlSerializer.Deserialize method and does not take XmlReader as a constructor parameter.
Cause
Deserializing untrusted XML input with System.Xml.Serialization.XmlSerializer.Deserialize instantiated without an XmlReader object can potentially lead to denial of service, information disclosure, and server-side request forgery attacks. These attacks are enabled by untrusted DTD and XML schema processing, which allows for the inclusion of XML bombs and malicious external entities in the XML. Only with XmlReader is it possible to disable DTD. Inline XML schema processing as XmlReader has the ProhibitDtd and ProcessInlineSchema property set to false by default in .NET Framework version 4.0 and later. The other options such as Stream, TextReader, and XmlSerializationReader cannot disable DTD processing.
How to fix violations
Do not use System.Xml.Serialization.XmlSerializer.Deserialize overloads other than System.Xml.Serialization.XmlSerializer.Deserialize(System.Xml.XmlReader), System.Xml.Serialization.XmlSerializer.Deserialize(System.Xml.XmlReader,System.String), System.Xml.Serialization.XmlSerializer.Deserialize(System.Xml.XmlReader,System.Xml.Serialization.XmlDeserializationEvents), or System.Xml.Serialization.XmlSerializer.Deserialize(System.Xml.XmlReader,System.String,System.Xml.Serialization.XmlDeserializationEvents).
Example
using System.IO;
using System.Xml.Serialization;
...
new XmlSerializer(typeof(TestClass).Deserialize(new FileStream("filename", FileMode.Open));
using System.IO;
using System.Xml;
using System.Xml.Serialization;
...
new XmlSerializer(typeof(TestClass)).Deserialize(XmlReader.Create (new FileStream("filename", FileMode.Open)));When to suppress
You can potentially suppress this warning if the parsed XML comes from a trusted source and hence cannot be tampered with.