Rules / C#
SHIELD-CSHARP-010
XXE via XmlTextReader without resolver hardening
What it detects
An XmlTextReader is created from a variable source without disabling DTD processing, allowing external entity resolution.
How to fix
Use XmlReader.Create with XmlReaderSettings that set DtdProcessing to Prohibit and XmlResolver to null.
Vulnerable — Shield flags thisUploadParser.cs
using System.Xml;
public class UploadParser
{
public void Parse(string uploadPath)
{
var reader = new XmlTextReader(uploadPath);
while (reader.Read()) { }
}
}
Fixed — scans cleanUploadParser.cs
using System.Xml;
public class UploadParser
{
public void Parse(string uploadPath)
{
var settings = new XmlReaderSettings();
settings.DtdProcessing = DtdProcessing.Prohibit;
settings.XmlResolver = null;
using var reader = XmlReader.Create(uploadPath, settings);
while (reader.Read()) { }
}
}
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-010, the fixed one does not.