Skip to content

Commit aaff2f6

Browse files
authored
Update ca3075-insecure-dtd-processing.md
1 parent a78f1f8 commit aaff2f6

File tree

1 file changed

+8
-8
lines changed

1 file changed

+8
-8
lines changed

docs/code-quality/ca3075-insecure-dtd-processing.md

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -30,25 +30,25 @@ A *Document Type Definition (DTD)* is one of two ways an XML parser can determin
3030

3131
- The <xref:System.Xml.XmlNode.InnerXml%2A> property in the XML is set.
3232

33-
- <xref:System.Xml.XmlReaderSettings.DtdProcessing%2A> property is set to Parse .
33+
- <xref:System.Xml.XmlReaderSettings.DtdProcessing%2A> property is set to Parse.
3434

35-
- Untrusted input is processed using <xref:System.Xml.XmlResolver> instead of <xref:System.Xml.XmlSecureResolver> .
35+
- Untrusted input is processed using <xref:System.Xml.XmlResolver> instead of <xref:System.Xml.XmlSecureResolver>.
3636

37-
- The XmlReader.<xref:System.Xml.XmlReader.Create%2A> method is invoked with an insecure <xref:System.Xml.XmlReaderSettings> instance or no instance at all.
37+
- The <xref:System.Xml.XmlReader.Create%2A?displayProperty=nameWithType> method is invoked with an insecure <xref:System.Xml.XmlReaderSettings> instance or no instance at all.
3838

39-
- <xref:System.Xml.XmlReader> is created with insecure default settings or values .
39+
- <xref:System.Xml.XmlReader> is created with insecure default settings or values.
4040

4141
In each of these cases, the outcome is the same: the contents from either the file system or network shares from the machine where the XML is processed will be exposed to the attacker, which may then be used as a DoS vector.
4242

4343
## How to fix violations
4444

45-
- Catch and process all XmlTextReader exceptions properly to avoid path information disclosure .
45+
- Catch and process all XmlTextReader exceptions properly to avoid path information disclosure.
4646

4747
- Use the <xref:System.Xml.XmlSecureResolver> to restrict the resources that the XmlTextReader can access.
4848

4949
- Do not allow the <xref:System.Xml.XmlReader> to open any external resources by setting the <xref:System.Xml.XmlResolver> property to **null**.
5050

51-
- Ensure that the <xref:System.Data.DataViewManager.DataViewSettingCollectionString%2A> property of <xref:System.Data.DataViewManager> is assigned from a trusted source.
51+
- Ensure that the <xref:System.Data.DataViewManager.DataViewSettingCollectionString%2A?displayProperty=nameWithType> property is assigned from a trusted source.
5252

5353
**.NET 3.5 and earlier**
5454

@@ -58,7 +58,7 @@ In each of these cases, the outcome is the same: the contents from either the fi
5858

5959
**.NET 4 and later**
6060

61-
- Avoid enabling DtdProcessing if you're dealing with untrusted sources by setting the <xref:System.Xml.XmlReaderSettings.DtdProcessing%2A?displayProperty=nameWithType> property to **Prohibit** or **Ignore**.
61+
- Avoid enabling DtdProcessing if you're dealing with untrusted sources by setting the <xref:System.Xml.XmlReaderSettings.DtdProcessing%2A?displayProperty=nameWithType> property to **Prohibit** or **Ignore**.
6262

6363
- Ensure that the Load() method takes an XmlReader instance in all InnerXml cases.
6464

@@ -361,4 +361,4 @@ namespace TestNamespace
361361
}
362362
}
363363
}
364-
```
364+
```

0 commit comments

Comments
 (0)