Using unvalidated XML can expose an application to several types of XML-related attacks:

* XML injection - the structure and/or contents of the document are changed by the addition of extra elements
* XML entity expansion - the size of the document is ballooned by injecting elements that expand exponentially, exhausing server resources
* XML external entity injection - entities are injected which result dynamically including data from another source, such as a sensitive file on the filesystem.

This rule checks that method parameters are not unconditionally used directly in XML.


== Noncompliant Code Example

----
private string writeXml(OleDbDataReader odr) {

  XmlTextWriter xTWriter = null;
  string key = String.Empty;
  string value = String.Empty;

  try 
  {
    while(oDR.Read()) 
    {
      key = odr.GetValue(0);
      value = odr.GetValue(1);
      xTWriter.WriteElementString(key, value);  // Noncompliant
    }
  }
}
----


== Compliant Solution

----

private string writeXml(OleDbDataReader odr) {

  XmlTextWriter xTWriter = null;
  string key = String.Empty;
  string value = String.Empty;

  try 
  {
    while(oDR.Read()) 
    {
      key = System.SecurityElement.Escape(odr.GetValue(0));
      value = System.SecurityElement.Escape(odr.GetValue(1));
      xTWriter.WriteElementString(key, value); 
    }
  }
}
----


== See

* https://www.owasp.org/index.php/Top_10-2017_A1-Injection[OWASP Top 10 2017 Category A1] - Injection
* https://www.owasp.org/index.php/Top_10-2017_A4-XML_External_Entities_(XXE)[OWASP Top 10 2017 Category A4] - XML External Entities (XXE)
* https://wiki.sei.cmu.edu/confluence/x/7jdGBQ[CERT, IDS51-J.] - Properly encode or escape output

