Disable DTD processing

jevgenijsp · jevgenijsp · commit a2e798738326 · 2024-12-09T10:05:26.000+02:00
diff --git a/src/Geta.NotFoundHandler/Core/Redirects/RedirectsXmlParser.cs b/src/Geta.NotFoundHandler/Core/Redirects/RedirectsXmlParser.cs
@@ -33,9 +33,17 @@ public RedirectsXmlParser(ILogger<RedirectsXmlParser> logger)
         public CustomRedirectCollection LoadFromStream(Stream xmlContent)
         {
             _customRedirectsXmlFile = new XmlDocument();
+
             if (xmlContent != null)
             {
-                _customRedirectsXmlFile.Load(xmlContent);
+                var settings = new XmlReaderSettings
+                {
+                    DtdProcessing = DtdProcessing.Prohibit,
+                    XmlResolver = null
+                };
+
+                using var reader = XmlReader.Create(xmlContent, settings);
+                _customRedirectsXmlFile.Load(reader);
             }
             else
             {

Original file line number	Diff line number	Diff line change
`@@ -33,9 +33,17 @@ public RedirectsXmlParser(ILogger<RedirectsXmlParser> logger)`
`33`	`33`	`public CustomRedirectCollection LoadFromStream(Stream xmlContent)`
`34`	`34`	`{`
`35`	`35`	`_customRedirectsXmlFile = new XmlDocument();`
	`36`	`+`
`36`	`37`	`if (xmlContent != null)`
`37`	`38`	`{`
`38`		`- _customRedirectsXmlFile.Load(xmlContent);`
	`39`	`+ var settings = new XmlReaderSettings`
	`40`	`+ {`
	`41`	`+ DtdProcessing = DtdProcessing.Prohibit,`
	`42`	`+ XmlResolver = null`
	`43`	`+ };`
	`44`	`+`
	`45`	`+ using var reader = XmlReader.Create(xmlContent, settings);`
	`46`	`+ _customRedirectsXmlFile.Load(reader);`
`39`	`47`	`}`
`40`	`48`	`else`
`41`	`49`	`{`