Use XmlReader for validating reader
Use XmlReader for validating reader
Microsoft docsDescription
Processing untrusted DTD and XML schemas may enable loading dangerous external references. This dangerous loading can be restricted by using an XmlReader with a secure resolver or with DTD and XML inline schema processing disabled. This rule detects code that uses the XmlValidatingReader class without XmlReader as a constructor parameter.
Cause
Validating untrusted XML input with the XmlValidatingReader class instantiated without an XmlReader object can potentially lead to denial of service, information disclosure, and server-side request forgery. These attacks are enabled by untrusted DTD and XML schema processing, which allows for the inclusion of XML bombs and malicious external entities in the XML. Only with XmlReader is it possible to disable DTD. Inline XML schema processing as XmlReader has the ProhibitDtd and ProcessInlineSchema property set to false by default in .NET Framework starting in version 4.0.
How to fix violations
- Use
XmlValidatingReader(XmlReader)withProhibitDtdandProcessInlineSchemaproperties set tofalse. - Starting in .NET Framework 2.0,
XmlValidatingReaderis considered obsolete. You can instantiate a validating reader with System.Xml.XmlReader.Create.
Example
using System;
using System.IO;
using System.Xml;
...
public void TestMethod(Stream xmlFragment, XmlNodeType fragType, XmlParserContext context)
{
var obj = new XmlValidatingReader(xmlFragment, fragType, context);
}
using System;
using System.Xml;
...
public void TestMethod(XmlReader xmlReader)
{
var obj = new XmlValidatingReader(xmlReader);
}When to suppress
You can potentially suppress this warning if the XmlValidatingReader is always used to validate XML that comes from a trusted source and hence cannot be tampered with.