Prevent XXE attack from XML parser

문서 > Datadog 보안 > Code Security > Static Code Analysis (SAST) > SAST 규칙 > Prevent XXE attack from XML parser

이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

ID: csharp-security/avoid-xml-xxe

Language: C#

Severity: Warning

Category: Security

CWE: 611

Description

Enabling processing of external data can lead to XML External Entity (XXE) attacks. To prevent this, disable external processing or make sure the external processing you are using is safe. Note that this vulnerability is important for .NET Framework prior to 4.5.2, latest revision are safe by default.

Learn More

CWE-611: Improper Restriction of XML External Entity Reference

Non-Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        
        if (foo) {
            var xmlDoc = new XmlDocument();
            xmlDoc.XmlResolver = new XmlUrlResolver();
            xmlDoc.LoadXml(xmlContent);
        }

    }
}

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        var xmlDoc = new XmlDocument();
        xmlDoc.XmlResolver = new XmlUrlResolver();
        xmlDoc.LoadXml(xmlContent);
    }
}

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        XmlDocument parser = new XmlDocument();
        parser.XmlResolver = new XmlUrlResolver();
        parser.LoadXml("myDocument.xml");
    }
}

Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        XmlDocument parser = new XmlDocument();
        parser.XmlResolver = null;
        parser.LoadXml("myDocument.xml");
    }
}