XML external entity (XXE) (ARCH329)

Key dotnet.security.xxe · Severity error · Category security · CWE CWE-611

XML parsers that leave DTD and external entity processing enabled let attackers read local files, perform SSRF, or launch denial-of-service attacks.

Incorrect

var settings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Parse,
    XmlResolver = new XmlUrlResolver()
};
using var reader = XmlReader.Create(input, settings);

Correct

var settings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit,
    XmlResolver = null
};
using var reader = XmlReader.Create(input, settings);

Fix

Set DtdProcessing to Prohibit and set XmlResolver to null to block external entity resolution.