diff --git a/tests/ZB.MOM.WW.ScadaBridge.NotificationService.Tests/Ews/EwsResponseParserTests.cs b/tests/ZB.MOM.WW.ScadaBridge.NotificationService.Tests/Ews/EwsResponseParserTests.cs index c60d8994..2c5c82da 100644 --- a/tests/ZB.MOM.WW.ScadaBridge.NotificationService.Tests/Ews/EwsResponseParserTests.cs +++ b/tests/ZB.MOM.WW.ScadaBridge.NotificationService.Tests/Ews/EwsResponseParserTests.cs @@ -116,8 +116,9 @@ public class EwsResponseParserTests public void Parse_PayloadWithDtdEntityDeclaration_IsRejectedAsUnparseable() { // Pins DTD-prohibited parsing (XXE guard). The response body is external input, so the - // parser must never process a DOCTYPE. XDocument.Parse prohibits DTDs by default; a - // refactor that supplies XmlReaderSettings with a looser DtdProcessing fails here. + // parser must never process a DOCTYPE. LINQ-to-XML does NOT prohibit DTDs on its own, so + // the parser reads through an XmlReader pinned to DtdProcessing.Prohibit with a null + // resolver; a refactor that loosens either setting fails here. // // The payload is deliberately a well-formed EWS response so the assertion has teeth: with // DTDs prohibited the DOCTYPE itself throws and the body is Unparseable, whereas any