test(notifications): correct XXE guard comment — LINQ-to-XML does not prohibit DTDs by default

2026-08-10 06:21:19 -04:00
parent 6864890e5f
commit 2ee5586406
1 changed files with 3 additions and 2 deletions
@@ -116,8 +116,9 @@ public class EwsResponseParserTests
    public void Parse_PayloadWithDtdEntityDeclaration_IsRejectedAsUnparseable()
    {
        // Pins DTD-prohibited parsing (XXE guard). The response body is external input, so the
-        // parser must never process a DOCTYPE. XDocument.Parse prohibits DTDs by default; a
-        // refactor that supplies XmlReaderSettings with a looser DtdProcessing fails here.
+        // parser must never process a DOCTYPE. LINQ-to-XML does NOT prohibit DTDs on its own, so
+        // the parser reads through an XmlReader pinned to DtdProcessing.Prohibit with a null
+        // resolver; a refactor that loosens either setting fails here.
        //
        // The payload is deliberately a well-formed EWS response so the assertion has teeth: with
        // DTDs prohibited the DOCTYPE itself throws and the body is Unparseable, whereas any