feat: security hardening from audit (XXE, Newtonsoft type handling, redaction) (#2181)

Security audit found no Critical/High issues; these are defense-in-depth
and behavior-change hardenings, safe by default.

- xml: force DtdProcessing.Prohibit and clear XmlResolver on every reader
  settings access to block XXE and entity-expansion attacks, with an
  obsolete AllowDtdProcessing opt-out for fully trusted sources
- newtonsoft: force TypeNameHandling.None when no explicit settings are
  supplied so an unsafe global JsonConvert.DefaultSettings cannot drive
  polymorphic deserialization of response bodies; explicit caller settings
  are still honored
- generator: escape U+0085/U+2028/U+2029 in emitted string literals (these
  break a regular literal, CS1010) and fix the literal length calculation
- regex: add a 1s match timeout to the net7+ GeneratedRegex for parity
- exceptions: add RefitSettings.ExceptionRedactor to scrub credentials and
  bodies before an ApiException propagates, and MaxExceptionContentLength to
  bound the error-body read; document the disclosure surface and make
  Content/RequestContent settable for redaction
- docs: add a V13 breaking-changes section to the README
- claude.md: document promoting PublicAPI unshipped to shipped before a PR

Tests and coverage:

- cover XXE rejection and the DTD opt-out, TypeNameHandling neutralize/honor,
  generator escaping, content cap, redaction, async error-body reads, and the
  problem+json validation path; remove dead negative-number handling from the
  generator's integer writer
- perf: cache Roslyn metadata references across generator tests. The harness
  rebuilt the full framework reference closure (~169 assemblies) per test, so
  parallel execution multiplied to ~31 GiB across the four TFMs and OOM-killed
  the CI runner. Materializing each reference once into a process-wide cache
  drops the net9.0 peak RSS from 8.3 GiB to 1.4 GiB and the four-TFM peak from
  30.8 GiB to 4.6 GiB

Author: glennawatson

CLAUDE.md

@@ -159,3 +159,14 @@ dotnet run --project "tests/Refit.GeneratorTests/Refit.GeneratorTests.csproj" -f
 - Keep changes scoped. Do not rewrite unrelated files while touching generator/runtime paths.
 - Prefer focused tests that compile or execute the real generated output when changing source generator behavior.
 
+---
+
+## Public API tracking
+
+The runtime projects use the public-API analyzer, so every public/protected member is recorded under `src/Refit/PublicAPI/<tfm>/`.
+
+- New public surface goes in `PublicAPI.Unshipped.txt` for each affected TFM while you iterate.
+- **Before opening a PR, move those new entries from `PublicAPI.Unshipped.txt` into the matching `PublicAPI.Shipped.txt` (and reset each unshipped file to just `#nullable enable`).** This repo ships almost immediately after merge, so unshipped API is promoted as part of the change rather than left pending.
+- For behavior changes or public API additions, also add a breaking-changes note to the README.
+- Shipped entries are assumed to be carried forward; you do not need to call them out separately in the PR.
+

README.md

@@ -40,6 +40,7 @@ services
 
 * [Sponsors](#sponsors)
 * [Where does this work?](#where-does-this-work)
+    * [Breaking changes in V13.x](#breaking-changes-in-v13x)
     * [Breaking changes in V12.x](#breaking-changes-in-v12x)
     * [Breaking changes in 11.x](#breaking-changes-in-11x)
     * [Breaking changes in 6.x](#breaking-changes-in-6x)
@@ -103,6 +104,34 @@ Refit currently supports the following platforms and modern .NET targets:
 
 ### SDK Requirements
 
+### V13.x.x
+
+#### Breaking changes in V13.x
+
+Refit 13 hardens the default security posture from a security audit. The new behavior is safe by default; the changes
+below only affect code that previously relied on the less-secure defaults.
+
+* **XML responses no longer process DTDs.** `XmlContentSerializer` now forces `DtdProcessing.Prohibit` and clears the
+  `XmlResolver` on every read, blocking XML External Entity (XXE) and entity-expansion ("billion laughs") attacks. If
+  you were deserializing trusted XML that depends on a DTD or external entities, that content will now throw. We
+  **strongly recommend against re-enabling DTD processing**, but if your XML comes from a fully trusted source you can
+  opt out via the obsolete `XmlReaderWriterSettings.AllowDtdProcessing` flag (marked `[Obsolete]` deliberately, so it
+  surfaces a compiler warning) - you must also configure `DtdProcessing`/`XmlResolver` yourself on `ReaderSettings`.
+  Prefer pre-processing untrusted documents instead.
+* **Newtonsoft.Json no longer inherits an unsafe global `TypeNameHandling`.** When you do not pass explicit
+  `JsonSerializerSettings`, `NewtonsoftJsonContentSerializer` now forces `TypeNameHandling.None` even if
+  `JsonConvert.DefaultSettings` configured a different value, closing a known remote-code-execution gadget vector on
+  response bodies. If you genuinely need polymorphic (`$type`) deserialization, opt in explicitly by passing your own
+  `JsonSerializerSettings` (ideally constrained with a `SerializationBinder`).
+
+The release also adds two opt-in, non-breaking knobs on `RefitSettings` for hardening exception handling:
+
+* `RefitSettings.ExceptionRedactor` — a hook invoked before an `ApiException` propagates, so you can scrub the
+  `Authorization` header, request/response bodies, and `Set-Cookie` before they reach logging or telemetry pipelines
+  that serialize exceptions.
+* `RefitSettings.MaxExceptionContentLength` — caps how many characters of an error response body are read into
+  `ApiException.Content`, bounding memory use against hostile or oversized error responses. Defaults to unbounded.
+
 ### V12.x.x
 
 #### Breaking changes in V12.x

src/InterfaceStubGenerator.Shared/Emitter.Helpers.cs

@@ -130,9 +130,73 @@ internal static void AppendEscapedCharacter(StringBuilder builder, char characte
             '\r' => builder.Append(@"\r"),
             '\t' => builder.Append(@"\t"),
             '\v' => builder.Append(@"\v"),
+
+            // Line terminators that would break out of a regular C# string literal (CS1010).
+            '\u0085' => builder.Append(@"\u0085"),
+            '\u2028' => builder.Append(@"\u2028"),
+            '\u2029' => builder.Append(@"\u2029"),
             _ => builder.Append(character)
         };
 
+    /// <summary>Gets the escape sequence for a C# string-literal character, or null when none is needed.</summary>
+    /// <param name="character">The character to escape.</param>
+    /// <returns>The escape sequence, or <see langword="null"/> when the character is emitted verbatim.</returns>
+    internal static string? EscapeSequence(char character) =>
+        character switch
+        {
+            '\\' => @"\\",
+            '"' => "\\\"",
+            '\0' => @"\0",
+            '\a' => @"\a",
+            '\b' => @"\b",
+            '\f' => @"\f",
+            '\n' => @"\n",
+            '\r' => @"\r",
+            '\t' => @"\t",
+            '\v' => @"\v",
+
+            // Characters C# treats as line terminators inside a regular string literal (CS1010).
+            '\u0085' => @"\u0085",
+            '\u2028' => @"\u2028",
+            '\u2029' => @"\u2029",
+            _ => null
+        };
+
+    /// <summary>Computes the rendered length of a C# string literal or the <c>null</c> keyword.</summary>
+    /// <param name="value">The value to quote, or <see langword="null"/>.</param>
+    /// <returns>The number of characters the rendered expression occupies.</returns>
+    internal static int LiteralOrNullLength(string? value)
+    {
+        if (value is null)
+        {
+            return NullLiteral.Length;
+        }
+
+        var length = StringLiteralQuoteLength;
+        foreach (var character in value)
+        {
+            length += EscapeSequence(character) is { Length: var escapeLength } ? escapeLength : 1;
+        }
+
+        return length;
+    }
+
+    /// <summary>Computes the rendered decimal length of a non-negative 32-bit integer.</summary>
+    /// <param name="value">The non-negative value to render (callers only pass <c>CollectionFormat</c> values).</param>
+    /// <returns>The number of characters the decimal rendering occupies.</returns>
+    internal static int Int32Length(int value)
+    {
+        var length = 0;
+        do
+        {
+            length++;
+            value /= DecimalRadix;
+        }
+        while (value > 0);
+
+        return length;
+    }
+
     /// <summary>Strips an explicit interface prefix from a method name (e.g. <c>IFoo.Bar</c> becomes <c>Bar</c>).</summary>
     /// <param name="name">The method name to normalize.</param>
     /// <returns>The method name without any explicit interface prefix.</returns>

src/InterfaceStubGenerator.Shared/Emitter.cs

@@ -870,61 +870,6 @@ private static string JoinParts(string[] parts, int count, string separator)
     /// <returns>The generated indentation.</returns>
     private static string Indent(int level) => new(' ', level * CharsPerIndentation);
 
-    /// <summary>Gets the two-character escape sequence for a C# string-literal character, or null when none is needed.</summary>
-    /// <param name="character">The character to escape.</param>
-    /// <returns>The interned escape sequence, or <see langword="null"/> when the character is emitted verbatim.</returns>
-    private static string? EscapeSequence(char character) =>
-        character switch
-        {
-            '\\' => "\\\\",
-            '"' => "\\\"",
-            '\0' => "\\0",
-            '\a' => "\\a",
-            '\b' => "\\b",
-            '\f' => "\\f",
-            '\n' => "\\n",
-            '\r' => "\\r",
-            '\t' => "\\t",
-            '\v' => "\\v",
-            _ => null
-        };
-
-    /// <summary>Computes the rendered length of a C# string literal or the <c>null</c> keyword.</summary>
-    /// <param name="value">The value to quote, or <see langword="null"/>.</param>
-    /// <returns>The number of characters the rendered expression occupies.</returns>
-    private static int LiteralOrNullLength(string? value)
-    {
-        if (value is null)
-        {
-            return NullLiteral.Length;
-        }
-
-        var length = StringLiteralQuoteLength;
-        foreach (var character in value)
-        {
-            length += EscapeSequence(character) is null ? 1 : StringLiteralQuoteLength;
-        }
-
-        return length;
-    }
-
-    /// <summary>Computes the rendered decimal length of a 32-bit integer.</summary>
-    /// <param name="value">The value to render.</param>
-    /// <returns>The number of characters the decimal rendering occupies.</returns>
-    private static int Int32Length(int value)
-    {
-        var length = value < 0 ? 1 : 0;
-        var magnitude = value < 0 ? -(long)value : value;
-        do
-        {
-            length++;
-            magnitude /= DecimalRadix;
-        }
-        while (magnitude > 0);
-
-        return length;
-    }
-
 #if NETSTANDARD2_0
     /// <summary>Writes a C# string literal or the <c>null</c> keyword into a generated string buffer.</summary>
     /// <param name="destination">The target character buffer.</param>
@@ -955,26 +900,20 @@ private static void AppendLiteralOrNull(char[] destination, string? value, ref i
         destination[position++] = '"';
     }
 
-    /// <summary>Writes the decimal rendering of a 32-bit integer into a generated string buffer.</summary>
+    /// <summary>Writes the decimal rendering of a non-negative 32-bit integer into a generated string buffer.</summary>
     /// <param name="destination">The target character buffer.</param>
-    /// <param name="value">The value to render.</param>
+    /// <param name="value">The non-negative value to render (callers only pass <c>CollectionFormat</c> values).</param>
     /// <param name="position">The current write position.</param>
     private static void AppendInt32(char[] destination, int value, ref int position)
     {
         var end = position + Int32Length(value);
         var write = end;
-        var magnitude = value < 0 ? -(long)value : value;
         do
         {
-            destination[--write] = (char)('0' + (int)(magnitude % DecimalRadix));
-            magnitude /= DecimalRadix;
-        }
-        while (magnitude > 0);
-
-        if (value < 0)
-        {
-            destination[position] = '-';
+            destination[--write] = (char)('0' + (value % DecimalRadix));
+            value /= DecimalRadix;
         }
+        while (value > 0);
 
         position = end;
     }
@@ -1008,26 +947,20 @@ private static void AppendLiteralOrNull(Span<char> destination, string? value, r
         destination[position++] = '"';
     }
 
-    /// <summary>Writes the decimal rendering of a 32-bit integer into a generated string buffer.</summary>
+    /// <summary>Writes the decimal rendering of a non-negative 32-bit integer into a generated string buffer.</summary>
     /// <param name="destination">The target character span.</param>
-    /// <param name="value">The value to render.</param>
+    /// <param name="value">The non-negative value to render (callers only pass <c>CollectionFormat</c> values).</param>
     /// <param name="position">The current write position.</param>
     private static void AppendInt32(Span<char> destination, int value, ref int position)
     {
         var end = position + Int32Length(value);
         var write = end;
-        var magnitude = value < 0 ? -(long)value : value;
         do
         {
-            destination[--write] = (char)('0' + (int)(magnitude % DecimalRadix));
-            magnitude /= DecimalRadix;
-        }
-        while (magnitude > 0);
-
-        if (value < 0)
-        {
-            destination[position] = '-';
+            destination[--write] = (char)('0' + (value % DecimalRadix));
+            value /= DecimalRadix;
         }
+        while (value > 0);
 
         position = end;
     }

src/Refit.Newtonsoft.Json/NewtonsoftJsonContentSerializer.cs

@@ -20,11 +20,26 @@ public sealed class NewtonsoftJsonContentSerializer(
     private const int QuotePairLength = 2;
 
     /// <summary>The <see cref="Lazy{T}"/> instance providing the JSON serialization settings to use</summary>
+    /// <remarks>
+    /// When the caller does not supply explicit settings, any settings inherited from
+    /// <see cref="JsonConvert.DefaultSettings"/> have <see cref="TypeNameHandling"/> forced to
+    /// <see cref="TypeNameHandling.None"/>. A globally configured non-<see cref="TypeNameHandling.None"/>
+    /// value would otherwise let an attacker-controlled HTTP response body drive polymorphic type
+    /// resolution (a known remote-code-execution gadget vector). Callers who genuinely need
+    /// polymorphic deserialization must opt in by passing their own <see cref="JsonSerializerSettings"/>.
+    /// </remarks>
     private readonly Lazy<JsonSerializerSettings> _jsonSerializerSettings =
         new(() =>
-            jsonSerializerSettings
-            ?? JsonConvert.DefaultSettings?.Invoke()
-            ?? new JsonSerializerSettings());
+        {
+            if (jsonSerializerSettings is not null)
+            {
+                return jsonSerializerSettings;
+            }
+
+            var settings = JsonConvert.DefaultSettings?.Invoke() ?? new JsonSerializerSettings();
+            settings.TypeNameHandling = TypeNameHandling.None;
+            return settings;
+        });
 
     /// <summary>Initializes a new instance of the <see cref="NewtonsoftJsonContentSerializer"/> class.</summary>
     public NewtonsoftJsonContentSerializer()

src/Refit.Xml/PublicAPI/net10.0/PublicAPI.Shipped.txt

@@ -25,3 +25,5 @@ Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlReaderSettin
 Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlReaderSettings! readerSettings, System.Xml.XmlWriterSettings! writerSettings) -> void
 Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlWriterSettings! writerSettings) -> void
 Refit.XmlContentSerializer.DeserializeFromString<T>(string! content) -> T?
+Refit.XmlReaderWriterSettings.AllowDtdProcessing.get -> bool
+Refit.XmlReaderWriterSettings.AllowDtdProcessing.set -> void

src/Refit.Xml/PublicAPI/net11.0/PublicAPI.Shipped.txt

@@ -25,3 +25,5 @@ Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlReaderSettin
 Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlReaderSettings! readerSettings, System.Xml.XmlWriterSettings! writerSettings) -> void
 Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlWriterSettings! writerSettings) -> void
 Refit.XmlContentSerializer.DeserializeFromString<T>(string! content) -> T?
+Refit.XmlReaderWriterSettings.AllowDtdProcessing.get -> bool
+Refit.XmlReaderWriterSettings.AllowDtdProcessing.set -> void

src/Refit.Xml/PublicAPI/net462/PublicAPI.Shipped.txt

@@ -25,3 +25,5 @@ Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlReaderSettin
 Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlReaderSettings! readerSettings, System.Xml.XmlWriterSettings! writerSettings) -> void
 Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlWriterSettings! writerSettings) -> void
 Refit.XmlContentSerializer.DeserializeFromString<T>(string! content) -> T?
+Refit.XmlReaderWriterSettings.AllowDtdProcessing.get -> bool
+Refit.XmlReaderWriterSettings.AllowDtdProcessing.set -> void

src/Refit.Xml/PublicAPI/net470/PublicAPI.Shipped.txt

@@ -25,3 +25,5 @@ Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlReaderSettin
 Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlReaderSettings! readerSettings, System.Xml.XmlWriterSettings! writerSettings) -> void
 Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlWriterSettings! writerSettings) -> void
 Refit.XmlContentSerializer.DeserializeFromString<T>(string! content) -> T?
+Refit.XmlReaderWriterSettings.AllowDtdProcessing.get -> bool
+Refit.XmlReaderWriterSettings.AllowDtdProcessing.set -> void

src/Refit.Xml/PublicAPI/net471/PublicAPI.Shipped.txt

@@ -25,3 +25,5 @@ Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlReaderSettin
 Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlReaderSettings! readerSettings, System.Xml.XmlWriterSettings! writerSettings) -> void
 Refit.XmlReaderWriterSettings.XmlReaderWriterSettings(System.Xml.XmlWriterSettings! writerSettings) -> void
 Refit.XmlContentSerializer.DeserializeFromString<T>(string! content) -> T?
+Refit.XmlReaderWriterSettings.AllowDtdProcessing.get -> bool
+Refit.XmlReaderWriterSettings.AllowDtdProcessing.set -> void