Prevent XXE attack from XML parser

Docs > Datadog Security > Code Security > Static Code Analysis (SAST) > SAST Rules > Prevent XXE attack from XML parser

Metadata

ID: csharp-security/avoid-xml-xxe

Language: C#

Severity: Warning

Category: Security

CWE: 611

Description

Enabling processing of external data can lead to XML External Entity (XXE) attacks. To prevent this, disable external processing or make sure the external processing you are using is safe. Note that this vulnerability is important for .NET Framework prior to 4.5.2, latest revision are safe by default.

Learn More

CWE-611: Improper Restriction of XML External Entity Reference

Non-Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        
        if (foo) {
            var xmlDoc = new XmlDocument();
            xmlDoc.XmlResolver = new XmlUrlResolver();
            xmlDoc.LoadXml(xmlContent);
        }

    }
}

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        var xmlDoc = new XmlDocument();
        xmlDoc.XmlResolver = new XmlUrlResolver();
        xmlDoc.LoadXml(xmlContent);
    }
}

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        XmlDocument parser = new XmlDocument();
        parser.XmlResolver = new XmlUrlResolver();
        parser.LoadXml("myDocument.xml");
    }
}

Compliant Code Examples

using System.Xml;

class MyClass {
    public static void payloadDecode()
    {
        XmlDocument parser = new XmlDocument();
        parser.XmlResolver = null;
        parser.LoadXml("myDocument.xml");
    }
}