How to configure the XML parser to disable external entity resolution in c#

c# veracode
MANISH KUMAR CHOUDHARY picture MANISH KUMAR CHOUDHARY · Aug 25, 2015 · Viewed 25.3k times · Source 
var xDoc = XDocument.Load(fileName);

I am using above code in a function to load an XML file. Functionality wise its working fine but it is showing following Veracode Flaw after Veracode check.

Description

The product processes an XML document that can contain XML entities with URLs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. By default, the XML entity resolver will attempt to resolve and retrieve external references. If attacker-controlled XML can be submitted to one of these functions, then the attacker could gain access to information about an internal network, local filesystem, or other sensitive data. This is known as an XML eXternal Entity (XXE) attack.

Recommendations

Configure the XML parser to disable external entity resolution.

What I need to do to resolve it.

Answer

Casey picture Casey · Jun 9, 2016

If you are not using external entity references in your XML, you can disable the resolver by setting it to null, from How to prevent XXE attack ( XmlDocument in .net)

XmlDocument xmlDoc = new XmlDocument();
xmlDoc.XmlResolver = null;
xmlDoc.LoadXml(OurOutputXMLString);

If you are expecting the document to contain entity references, then you will need to create a custom resolver and whitelist what you are expecting. Especially, any references to websites that you do not control.

Related questions

How to fix "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')"

After running VeraCode, it reported a following error "Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')" in the following code fragment: protected override void InitializeCulture() { //If true then setup the ability to have a different culture loaded …

Read More
What is the best way to fix "Improper Restriction of xml external entity reference"?

We recently run VeraCode that points out on the following method: public XmlElement RunProcedureXmlElement(string Procedure, List<SqlParameter> Parameters) { DataSet ds = RunProcedureDataSet(Procedure, Parameters); XmlDocument xmlDoc = new XmlDocument(); StringBuilder strXML = new StringBuilder(); foreach (DataTable dt in ds.Tables) { …

Read More
How do I generate a random int number?

How do I generate a random integer in C#?

Read More