Added encoding explicitly when XmlReader is created for non-utf-8 cases #919
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| else | ||
| { | ||
| var streamReaderWithEncoding = new StreamReader(stream, _writeEncoding); | ||
| reader = XmlReader.Create(streamReaderWithEncoding, new XmlReaderSettings() { IgnoreWhitespace = true, DtdProcessing = DtdProcessing.Prohibit, CloseInput = true }); |
Check failure
Code scanning / CodeQL
Untrusted XML is read insecurely
There was a problem hiding this comment.
Tried to inline settings like it was before - but it still doesn't recognize that DtdProcessing = DtdProcessing.Prohibit is set.
According to https://codeql.github.com/codeql-query-help/csharp/cs-xml-insecure-dtd-handling/:
The solution is to set the DtdProcessing property to DtdProcessing.Prohibit.
..so it still looks like a false positive to me.
|
@kotovaleksandr thanks for approving. Any ETA for NuGet package release with the fix? |
|
Nice, thanks a lot. 👍 |
|
Seems like this fix wasn't fully enough, more flexibility is needed to control encodings in non-utf world.. |
A fix for #918, when encoding should be specified explicitly if web service should work with encodings other than utf-8 (or any other utf encodings). It's an improvement for a previous fix for ISO-8859-1 support (#429).
It creates a new
StreamReaderon top of existingstream, which might look like a hack. However in fact initialstreamis coming from some .NET internals likeHttpContext.Request.Bodyand as much as I understand - by default it's always UTF-8 nowadays. I didn't find any better way to switch the encoding for the underlying stream.In addition I added
CloseInput = trueproperty onXmlReaderSettings, which should handle and close additionally createdStreamReader.