flawopen.com/XXE/.NET XmlReader
On modern .NET, yes by default — XmlReader prohibits DTD processing unless you enable it. The risk lives in legacy .NET Framework code and in the other XML types: older XmlDocument and XmlTextReader shipped with an XmlResolver that resolved external entities.
// .NET Framework, older versions: // XmlDocument had a non-null resolver var doc = new XmlDocument(); doc.Load(untrustedStream); // XmlTextReader likewise var rdr = new XmlTextReader(stream); while (rdr.Read()) { } // Explicitly re-enabling it is always // dangerous with untrusted input: var settings = new XmlReaderSettings { DtdProcessing = DtdProcessing.Parse, XmlResolver = new XmlUrlResolver() };
var settings = new XmlReaderSettings {
// Reject documents with a DTD
DtdProcessing = DtdProcessing.Prohibit,
// No external resource resolution
XmlResolver = null,
MaxCharactersFromEntities = 1024,
};
using var reader =
XmlReader.Create(stream, settings);
// If you must use XmlDocument, null
// the resolver explicitly:
var doc = new XmlDocument {
XmlResolver = null
};
doc.Load(reader);.NET has several XML APIs whose defaults have differed, and whose defaults have also changed across framework versions. The practical summary:
Because the answer depends on both the type and the target framework, the durable approach is to configure XmlReaderSettings explicitly at every boundary where untrusted XML enters, rather than relying on the default being correct wherever the code is eventually compiled.
It caps the total characters produced by entity expansion, which limits billion-laughs style denial of service in cases where a DTD is permitted. It is a useful secondary control; prohibiting DTD processing outright is stronger.
Ignore skips the DTD silently; Prohibit throws. Prefer Prohibit for untrusted input, because failing loudly surfaces unexpected documents rather than processing them in a partially-understood state.
Yes. Anything that parses XML supplied by another party — web service payloads, SAML assertions, OOXML documents, configuration uploads — needs the same hardening at the point the reader is constructed.