Change DtdProcessing.Parse to DtdProcessing.Prohibit in XML loading helpers#25268
Change DtdProcessing.Parse to DtdProcessing.Prohibit in XML loading helpers#25268rolfbjarne wants to merge 1 commit intomainfrom
Conversation
Prevents inline DTD processing (entity expansion DoS vector) in XML loading helpers. Apple plist files declare a DTD but don't depend on DTD processing for correctness. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
✅ [PR Build #185a42d] Build passed (Build packages) ✅Pipeline on Agent |
✅ [PR Build #185a42d] Build passed (Detect API changes) ✅Pipeline on Agent |
✅ API diff for current PR / commitNET (empty diffs)✅ API diff vs stableNET (empty diffs)ℹ️ Generator diffGenerator Diff: vsdrops (html) vsdrops (raw diff) gist (raw diff) - Please review changes) Pipeline on Agent |
✅ [CI Build #185a42d] Build passed (Build macOS tests) ✅Pipeline on Agent |
This comment has been minimized.
This comment has been minimized.
🚀 [CI Build #185a42d] Test results 🚀Test results✅ All tests passed on VSTS: test results. 🎉 All 156 tests passed 🎉 Tests counts✅ cecil: All 1 tests passed. Html Report (VSDrops) Download macOS tests✅ Tests on macOS Monterey (12): All 5 tests passed. Html Report (VSDrops) Download Linux Build VerificationPipeline on Agent |
3 participants
Multiple XML loading helpers use
DtdProcessing.Parse, which enables inline DTD processing and opens a vector for entity expansion DoS ("billion laughs"). WhileXmlResolver = nullprevents external entity resolution, inline DTDs are still processed. Apple plist files declare a DTD but don't depend on DTD processing for correctness.This PR changes
DtdProcessing.ParsetoDtdProcessing.Prohibitin all affected locations:tools/common/PListExtensions.cs— 2 occurrences (file and string overloads)src/bgen/Extensions/ExtensionMethods.cs— 1 occurrencetests/cecil-tests/Helper.cs— 1 occurrencetests/mtouch/MTouch.cs— 1 occurrencetests/common/ProductTests.cs— 1 occurrence🤖 Pull request created by Copilot