XML DTD exception after v6.7.0

[hglee]

I updated to v7.0.0, but I got XML DTD exception. It seems to started after v6.7.0, da72f22

Is there any way to set XmlReaderSettings from user code?

I attached a sample xml file.

NmapScanSample01.xml

[dsyme]

Thanks, I'll revert that

[github-actions]

🤖 This is an automated response from Repo Assist.

Thanks for reporting this, @hglee. The XXE fix in #1596 set DtdProcessing = Prohibit and XmlResolver = null on the XmlReader, which is the right default from a security standpoint (XML External Entity attacks), but it has the unfortunate side-effect of rejecting any XML that references a DTD — including Nmap scan output, which uses (!DOCTYPE nmaprun).

@dsyme has already opened PR #1633 to revert the change for now.

Going forward, the right long-term solution would be to add an explicit DtdProcessing or AllowDtd static parameter to XmlProvider so that users who need DTD support can opt in, while keeping the secure default for everyone else:

// Future API sketch — secure by default
type T = XmlProvider<"...", DtdProcessing="Ignore">   // silently ignore DTD declarations
type T = XmlProvider<"...", DtdProcessing="Parse">    // allow DTD (needed for Nmap, etc.)

In the meantime, once PR #1633 is merged you should be able to use the reverted build without the XmlException.

Generated by Repo Assist

To install this workflow, run gh aw add githubnext/agentics/workflows/repo-assist.md@828ac109efb43990f59475cbfce90ede5546586c. View source at https://github.com/githubnext/agentics/tree/828ac109efb43990f59475cbfce90ede5546586c/workflows/repo-assist.md.

[github-actions]

🤖 This is an automated response from Repo Assist.

Thanks for the detailed report! This is a known breakage from PR #1596 which hardcoded DtdProcessing.Prohibit for all XML parsing.

I've submitted a draft PR that adds a DtdProcessing static parameter to XmlProvider, so you can opt in to handling DTD-bearing XML like Nmap scan output:

// Silently skip DTD — safe for Nmap, XHTML, and most real-world cases
type Nmap = XmlProvider<"nmap_scan.xml", DtdProcessing="Ignore">

The default remains "Prohibit" (preserving the security improvement from #1596), and "Parse" is also available for full DTD entity expansion.

Note that @dsyme also has PR #1633 open which reverts #1596 entirely — the maintainer will decide which approach to take.

Generated by Repo Assist

To install this workflow, run gh aw add githubnext/agentics/workflows/repo-assist.md@828ac109efb43990f59475cbfce90ede5546586c. View source at https://github.com/githubnext/agentics/tree/828ac109efb43990f59475cbfce90ede5546586c/workflows/repo-assist.md.

Warning

⚠️ Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• schemas.microsoft.com
• tomasp.net

[dsyme]

@hglee The revert was done in 7.0.1, thank you for the quick report!!!