Don't enable external XML entity resolution (XXE)

Rule ND3111 Security

Matches methods that create an XmlUrlResolver (or the obsolete XmlSecureResolver), enable XsltSettings.TrustedXslt / EnableScript / EnableDocumentFunction, or call the obsolete ProhibitDtd setter. With external entity resolution enabled, a crafted document can read local files (*file:///etc/passwd*), reach internal HTTP endpoints (SSRF) or explode memory (billion laughs). https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#net

This is CWE-611 Improper Restriction of XML External Entity Reference.

Flagged Code
public XmlReader OpenUntrusted(Stream xml) {
   var settings = new XmlReaderSettings {
      DtdProcessing = DtdProcessing.Parse,
      XmlResolver = new XmlUrlResolver()  // flagged: external entities get fetched
   };
   return XmlReader.Create(xml, settings);
}
Fixed Code
public XmlReader OpenUntrusted(Stream xml) {
   var settings = new XmlReaderSettings {
      DtdProcessing = DtdProcessing.Prohibit,  // the default
      XmlResolver = null
   };
   return XmlReader.Create(xml, settings);
}

How to fix

Leave XmlResolver null (the default in .NET Core and .NET Framework 4.5.2+), keep DtdProcessing.Prohibit (or Ignore) in XmlReaderSettings, and use XsltSettings.Default. If external resolution is required for trusted documents only, restrict the resolver to a whitelist and suppress the issue with a justification.

CQLinq source

This rule is written in CQLinq, C# LINQ over the NDepend code model. It ships with every new NDepend project: you can read it, adapt it, or use it as a starting point for your own custom rules.

// <Name>Don't enable external XML entity resolution (XXE)</Name>
// <Id>ND3111:DontEnableExternalXmlEntityResolution</Id>
warnif count > 0

// Third-party members are part of the code model only when the application uses them.
let xxeMembers =
   // An XmlUrlResolver fetches external entities and DTDs from arbitrary URLs.
   ThirdParty.Types.WithFullNameIn("System.Xml.XmlUrlResolver", "System.Xml.XmlSecureResolver")
      .ChildMethods().Where(m => m.IsConstructor)
   // Trusted XSLT: script blocks and document() function execute during the transform.
   .Concat(ThirdParty.Types.WithFullName("System.Xml.Xsl.XsltSettings")
      .ChildMethods().Where(m => m.SimpleNameEqualsAny("get_TrustedXslt", "set_EnableScript", "set_EnableDocumentFunction")))
   // ProhibitDtd is obsolete; the only reason to call the setter is to set it to false.
   .Concat(ThirdParty.Types.WithFullNameIn("System.Xml.XmlReaderSettings", "System.Xml.XmlTextReader")
      .ChildMethods().Where(m => m.SimpleName == "set_ProhibitDtd"))
   .ToHashSetEx()

where xxeMembers.Any()

from m in Application.Methods.UsingAny(xxeMembers)
let xxeMembersUsed = m.MethodsCalled.Intersect(xxeMembers).ToArray()
select new {
  m,
  xxeMembersUsed,
  Debt = 30.ToMinutes().ToDebt(),
  Severity = Severity.High
}

//<Expl>
// The *{0}* calls *{1}*, which lets an XML document pull external
// entities or run trusted XSLT features. If the XML comes from an
// untrusted source this exposes files, internal endpoints and denial of service.
//</Expl>

//<Desc>
// Matches methods that create an *XmlUrlResolver* (or the obsolete
// *XmlSecureResolver*), enable *XsltSettings.TrustedXslt* / *EnableScript*
// / *EnableDocumentFunction*, or call the obsolete *ProhibitDtd* setter.
// With external entity resolution enabled, a crafted document can read
// local files (*file:///etc/passwd*), reach internal HTTP endpoints
// (SSRF) or explode memory (*billion laughs*).
// https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#net
//
// This is CWE-611 *Improper Restriction of XML External Entity Reference*.
//
// **Flagged Code**
// ```csharp
// public XmlReader OpenUntrusted(Stream xml) {
//    var settings = new XmlReaderSettings {
//       DtdProcessing = DtdProcessing.Parse,
//       XmlResolver = new XmlUrlResolver()  // flagged: external entities get fetched
//    };
//    return XmlReader.Create(xml, settings);
// }
// ```
//
// **Fixed Code**
// ```csharp
// public XmlReader OpenUntrusted(Stream xml) {
//    var settings = new XmlReaderSettings {
//       DtdProcessing = DtdProcessing.Prohibit,  // the default
//       XmlResolver = null
//    };
//    return XmlReader.Create(xml, settings);
// }
// ```
//</Desc>

//<HowToFix>
// Leave *XmlResolver* null (the default in .NET Core and .NET Framework
// 4.5.2+), keep *DtdProcessing.Prohibit* (or *Ignore*) in
// *XmlReaderSettings*, and use *XsltSettings.Default*. If external
// resolution is required for trusted documents only, restrict the resolver
// to a whitelist and suppress the issue with a justification.
//</HowToFix>

Open in the interactive Rules Explorer · All default rules

Security: all 39 items