dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

test(notifications): correct XXE guard comment — LINQ-to-XML does not prohibit DTDs by default

Browse Source
This commit is contained in:
Joseph Doherty
2026-08-10 06:21:19 -04:00
parent 6864890e5f
commit 2ee5586406
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/ZB.MOM.WW.ScadaBridge.NotificationService.Tests/Ews/EwsResponseParserTests.cs
+3 -2
View File
@@ -116,8 +116,9 @@ public class EwsResponseParserTests
public void Parse_PayloadWithDtdEntityDeclaration_IsRejectedAsUnparseable() public void Parse_PayloadWithDtdEntityDeclaration_IsRejectedAsUnparseable()
{ {
// Pins DTD-prohibited parsing (XXE guard). The response body is external input, so the // Pins DTD-prohibited parsing (XXE guard). The response body is external input, so the
// parser must never process a DOCTYPE. XDocument.Parse prohibits DTDs by default; a // parser must never process a DOCTYPE. LINQ-to-XML does NOT prohibit DTDs on its own, so
// refactor that supplies XmlReaderSettings with a looser DtdProcessing fails here. // the parser reads through an XmlReader pinned to DtdProcessing.Prohibit with a null
// resolver; a refactor that loosens either setting fails here.
// //
// The payload is deliberately a well-formed EWS response so the assertion has teeth: with // The payload is deliberately a well-formed EWS response so the assertion has teeth: with
// DTDs prohibited the DOCTYPE itself throws and the body is Unparseable, whereas any // DTDs prohibited the DOCTYPE itself throws and the body is Unparseable, whereas any