From 2ee55864063948fcc42c2c82d85c99a321389f55 Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Mon, 10 Aug 2026 06:21:19 -0400 Subject: [PATCH] =?UTF-8?q?test(notifications):=20correct=20XXE=20guard=20?= =?UTF-8?q?comment=20=E2=80=94=20LINQ-to-XML=20does=20not=20prohibit=20DTD?= =?UTF-8?q?s=20by=20default?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../Ews/EwsResponseParserTests.cs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tests/ZB.MOM.WW.ScadaBridge.NotificationService.Tests/Ews/EwsResponseParserTests.cs b/tests/ZB.MOM.WW.ScadaBridge.NotificationService.Tests/Ews/EwsResponseParserTests.cs index c60d8994..2c5c82da 100644 --- a/tests/ZB.MOM.WW.ScadaBridge.NotificationService.Tests/Ews/EwsResponseParserTests.cs +++ b/tests/ZB.MOM.WW.ScadaBridge.NotificationService.Tests/Ews/EwsResponseParserTests.cs @@ -116,8 +116,9 @@ public class EwsResponseParserTests public void Parse_PayloadWithDtdEntityDeclaration_IsRejectedAsUnparseable() { // Pins DTD-prohibited parsing (XXE guard). The response body is external input, so the - // parser must never process a DOCTYPE. XDocument.Parse prohibits DTDs by default; a - // refactor that supplies XmlReaderSettings with a looser DtdProcessing fails here. + // parser must never process a DOCTYPE. LINQ-to-XML does NOT prohibit DTDs on its own, so + // the parser reads through an XmlReader pinned to DtdProcessing.Prohibit with a null + // resolver; a refactor that loosens either setting fails here. // // The payload is deliberately a well-formed EWS response so the assertion has teeth: with // DTDs prohibited the DOCTYPE itself throws and the body is Unparseable, whereas any