41 lines
798 B
Plaintext
41 lines
798 B
Plaintext
== How to fix it in .NET
|
|
|
|
=== Code examples
|
|
|
|
include::../../common/fix/code-rationale.adoc[]
|
|
|
|
==== Noncompliant code example
|
|
|
|
[source,csharp,diff-id=1,diff-type=noncompliant]
|
|
----
|
|
using System.Xml;
|
|
|
|
public static void decode()
|
|
{
|
|
XmlDocument parser = new XmlDocument();
|
|
parser.XmlResolver = new XmlUrlResolver(); // Noncompliant
|
|
parser.LoadXml("xxe.xml");
|
|
}
|
|
----
|
|
|
|
==== Compliant solution
|
|
|
|
`XmlDocument` is safe by default since .NET Framework 4.5.2. For older versions,
|
|
set `XmlResolver` explicitly to `null`.
|
|
|
|
[source,csharp,diff-id=1,diff-type=compliant]
|
|
----
|
|
using System.Xml;
|
|
|
|
public static void decode()
|
|
{
|
|
XmlDocument parser = new XmlDocument();
|
|
parser.XmlResolver = null;
|
|
parser.LoadXml("xxe.xml");
|
|
}
|
|
----
|
|
|
|
=== How does this work?
|
|
|
|
include::../../common/fix/xxe.adoc[]
|