Zennoxa Shield
Rules / C#
SHIELD-CSHARP-009

XXE via unsafe DtdProcessing or XmlResolver

highC#CWE-611CVSS 8.2

What it detects

An XML reader enables DtdProcessing.Parse or assigns an XmlResolver, exposing the parser to XXE attacks.

How to fix

Set DtdProcessing to Prohibit and XmlResolver to null when parsing untrusted XML.

Vulnerable — Shield flags thisFeedImporter.cs
using System.IO;
using System.Xml;

public class FeedImporter
{
    public XmlReader Open(Stream feed)
    {
        var settings = new XmlReaderSettings();
        settings.DtdProcessing = DtdProcessing.Parse;
        settings.XmlResolver = new XmlUrlResolver();
        return XmlReader.Create(feed, settings);
    }
}
Fixed — scans cleanFeedImporter.cs
using System.IO;
using System.Xml;

public class FeedImporter
{
    public XmlReader Open(Stream feed)
    {
        var settings = new XmlReaderSettings();
        settings.DtdProcessing = DtdProcessing.Prohibit;
        settings.XmlResolver = null;
        return XmlReader.Create(feed, settings);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-009, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-009: XXE via unsafe DtdProcessing or XmlResolver — Zennoxa Shield