🔵Info0.0

.NET XXE Prevention

Secure XML parsing configuration for .NET Framework, .NET Core, and .NET 5+ applications to prevent XXE vulnerabilities.

CWE-611: Improper Restriction of XML External Entity ReferenceOWASP Top 10:2021 - A05: Security Misconfiguration

Overview

.NET provides multiple XML parsing APIs with varying security defaults. Understanding which API you're using and its default behavior is critical for XXE prevention.

Key .NET XML APIs:

XmlDocument - Legacy DOM parser (vulnerable by default in .NET Framework)
XmlTextReader - Stream-based reader (vulnerable by default)
XmlReader - Abstract base class (secure defaults in .NET 4.5.2+)
XDocument (LINQ to XML) - Modern API (secure defaults in .NET 4.5.2+)
XmlSerializer - Object serialization (requires configuration)

Security Evolution:

.NET Framework < 4.5.2: Vulnerable by default
.NET Framework 4.5.2+: Secure defaults for XmlReader
.NET Core / .NET 5+: Secure defaults for all parsers

Important: Even with secure defaults, explicit configuration is recommended for defense in depth.

Vulnerable XmlDocument (.NET Framework)

C#VulnerableXMLParser.cs⚠️ Vulnerable
using System.Xml;

public class VulnerableXMLParser
{
    public void ParseXML(string xmlData)
    {
        // VULNERABLE in .NET Framework < 4.5.2
        // XmlResolver enabled by default
        XmlDocument doc = new XmlDocument();
        doc.LoadXml(xmlData);
        
        // XXE payload will be processed:
        // External entities loaded and expanded
        // File disclosure and SSRF possible
        
        string content = doc.InnerText;
        Console.WriteLine(content);
    }
}

Secure XmlDocument Configuration

C#SecureXMLParser.cs✓ Secure
using System.Xml;

public class SecureXMLParser
{
    public void ParseXML(string xmlData)
    {
        XmlDocument doc = new XmlDocument();
        
        // SECURE: Disable XmlResolver (prevents external entity loading)
        doc.XmlResolver = null;  // Critical security setting
        
        // Additional security: Use safe reader settings
        XmlReaderSettings settings = new XmlReaderSettings
        {
            DtdProcessing = DtdProcessing.Prohibit,  // Disallow DTDs completely
            XmlResolver = null  // Disable external entity resolution
        };
        
        using (StringReader stringReader = new StringReader(xmlData))
        using (XmlReader reader = XmlReader.Create(stringReader, settings))
        {
            doc.Load(reader);
        }
        
        string content = doc.InnerText;
        Console.WriteLine(content);
    }
}

Secure XmlReader Configuration (Recommended)

C#SecureXmlReaderParser.cs✓ Secure
using System.Xml;
using System.IO;

public class SecureXmlReaderParser
{
    public void ParseXML(string xmlData)
    {
        // RECOMMENDED: Use XmlReaderSettings with explicit security
        XmlReaderSettings settings = new XmlReaderSettings
        {
            // Primary defense: Prohibit DTD processing
            DtdProcessing = DtdProcessing.Prohibit,  // Strongest protection
            
            // If DTDs are required, use DtdProcessing.Parse with secure resolver:
            // DtdProcessing = DtdProcessing.Parse,
            // XmlResolver = null,  // Disable external entities
            
            // Additional security settings
            XmlResolver = null,           // Disable external entity resolution
            MaxCharactersFromEntities = 0, // Prevent entity expansion
            
            // Optional: Prevent DoS via large documents
            MaxCharactersInDocument = 10000000  // 10MB limit
        };
        
        using (StringReader stringReader = new StringReader(xmlData))
        using (XmlReader reader = XmlReader.Create(stringReader, settings))
        {
            while (reader.Read())
            {
                if (reader.NodeType == XmlNodeType.Element)
                {
                    Console.WriteLine($"Element: {reader.Name}");
                }
            }
        }
    }
}

Secure XDocument (LINQ to XML)

C#SecureXDocumentParser.cs✓ Secure
using System.Xml.Linq;
using System.Xml;
using System.IO;

public class SecureXDocumentParser
{
    public void ParseXML(string xmlData)
    {
        // XDocument is secure by default in .NET 4.5.2+
        // But explicit configuration is recommended
        
        XmlReaderSettings settings = new XmlReaderSettings
        {
            DtdProcessing = DtdProcessing.Prohibit,
            XmlResolver = null
        };
        
        using (StringReader stringReader = new StringReader(xmlData))
        using (XmlReader reader = XmlReader.Create(stringReader, settings))
        {
            XDocument doc = XDocument.Load(reader);
            
            // Process XML safely with LINQ
            var elements = from elem in doc.Descendants()
                          where elem.Name == "data"
                          select elem.Value;
            
            foreach (var value in elements)
            {
                Console.WriteLine(value);
            }
        }
    }
}

Secure XmlSerializer

C#SecureXmlSerializerParser.cs✓ Secure
using System.Xml.Serialization;
using System.Xml;
using System.IO;

public class Person
{
    public string Name { get; set; }
    public int Age { get; set; }
}

public class SecureXmlSerializerParser
{
    public Person DeserializeXML(string xmlData)
    {
        XmlSerializer serializer = new XmlSerializer(typeof(Person));
        
        // Secure XmlReader settings
        XmlReaderSettings settings = new XmlReaderSettings
        {
            DtdProcessing = DtdProcessing.Prohibit,
            XmlResolver = null,
            MaxCharactersFromEntities = 0
        };
        
        using (StringReader stringReader = new StringReader(xmlData))
        using (XmlReader reader = XmlReader.Create(stringReader, settings))
        {
            // Deserialize with secure reader
            Person person = (Person)serializer.Deserialize(reader);
            return person;
        }
    }
}

DtdProcessing Options Explained

DtdProcessing.Prohibit (Recommended):

Completely disallows DTD processing
Parser throws XmlException if DTD found
Strongest protection against XXE and DoS
Use this unless DTD validation required

DtdProcessing.Ignore:

Skips over DTD declarations without processing
Less safe than Prohibit
Can still be vulnerable in some scenarios
Not recommended

DtdProcessing.Parse:

Allows DTD processing
Only use with XmlResolver = null
Required if you need DTD validation
Must be explicitly secured

Best Practice: Always use DtdProcessing.Prohibit unless you have a specific requirement for DTD validation. If DTDs are needed, use DtdProcessing.Parse with XmlResolver = null.

ASP.NET Configuration

C#XmlController.cs✓ Secure
using Microsoft.AspNetCore.Mvc;
using System.Xml;
using System.IO;

[ApiController]
[Route("api/[controller]")]
public class XmlController : ControllerBase
{
    [HttpPost]
    public IActionResult ProcessXml([FromBody] string xmlData)
    {
        try
        {
            // Secure XML processing in ASP.NET Core
            XmlReaderSettings settings = new XmlReaderSettings
            {
                DtdProcessing = DtdProcessing.Prohibit,
                XmlResolver = null,
                MaxCharactersFromEntities = 0,
                MaxCharactersInDocument = 10000000,  // 10MB limit
                
                // Additional ASP.NET security
                ConformanceLevel = ConformanceLevel.Document,
                IgnoreComments = true,
                IgnoreProcessingInstructions = true
            };
            
            using (StringReader stringReader = new StringReader(xmlData))
            using (XmlReader reader = XmlReader.Create(stringReader, settings))
            {
                XmlDocument doc = new XmlDocument();
                doc.XmlResolver = null;  // Always set this for XmlDocument
                doc.Load(reader);
                
                // Process safely
                return Ok(new { status = "success" });
            }
        }
        catch (XmlException ex)
        {
            // Don't leak XML parse details in error messages
            return BadRequest(new { error = "Invalid XML format" });
        }
    }
}

Framework-Specific Guidance

.NET Framework 4.5.1 and Earlier:

All XML parsers vulnerable by default
MUST explicitly set XmlResolver = null
MUST set DtdProcessing = DtdProcessing.Prohibit
Upgrade to 4.5.2+ if possible

.NET Framework 4.5.2 - 4.8:

XmlReader secure by default (XmlResolver = null)
XmlDocument still requires XmlResolver = null
Explicit configuration still recommended
Consider migrating to .NET Core/.NET 5+

.NET Core 2.0+ / .NET 5+:

All XML parsers secure by default
XmlResolver = null by default
DTD processing disabled by default for most APIs
Still use explicit settings for defense in depth

Web.config Settings (.NET Framework):

<configuration>
  <appSettings>
    <!-- These don't directly affect XML parsing -->
    <!-- Must configure parsers in code -->
  </appSettings>
</configuration>

Testing XXE Prevention

C#XXEPreventionTests.cs✓ Secure
using Xunit;
using System.Xml;
using System;

public class XXEPreventionTests
{
    [Fact]
    public void TestXXEBlocked()
    {
        string xxePayload = @"
            <?xml version=""1.0"" encoding=""UTF-8""?>
            <!DOCTYPE root [
              <!ENTITY xxe SYSTEM ""file:///etc/passwd"">
            ]>
            <root>
              <data>&xxe;</data>
            </root>";
        
        XmlReaderSettings settings = new XmlReaderSettings
        {
            DtdProcessing = DtdProcessing.Prohibit,
            XmlResolver = null
        };
        
        // Should throw XmlException
        Assert.Throws<XmlException>(() =>
        {
            using (StringReader stringReader = new StringReader(xxePayload))
            using (XmlReader reader = XmlReader.Create(stringReader, settings))
            {
                while (reader.Read()) { }
            }
        });
    }
    
    [Fact]
    public void TestValidXMLAccepted()
    {
        string validXml = @"<root><data>valid content</data></root>";
        
        XmlReaderSettings settings = new XmlReaderSettings
        {
            DtdProcessing = DtdProcessing.Prohibit,
            XmlResolver = null
        };
        
        // Should parse without error
        using (StringReader stringReader = new StringReader(validXml))
        using (XmlReader reader = XmlReader.Create(stringReader, settings))
        {
            while (reader.Read())
            {
                Assert.NotNull(reader);
            }
        }
    }
}