Prevent XXE attack from XML parser

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Metadata

ID: csharp-security/avoid-xml-xxe

Language: C#

Severity: Warning

Category: Security

CWE: 611

Description

Enabling processing of external data can lead to XML External Entity (XXE) attacks. To prevent this, disable external processing or make sure the external processing you are using is safe. Note that this vulnerability is important for .NET Framework prior to 4.5.2, latest revision are safe by default.

Learn More

Non-Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        XmlDocument parser = new XmlDocument();
        parser.XmlResolver = new XmlUrlResolver();
        parser.LoadXml("myDocument.xml");
    }
}

Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        XmlDocument parser = new XmlDocument();
        parser.XmlResolver = null;
        parser.LoadXml("myDocument.xml");
    }
}