Disable DTD processing

Geta · Dec 9, 2024 · a2e7987 · a2e7987
1 parent a80cc6d
commit a2e7987
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/src/Geta.NotFoundHandler/Core/Redirects/RedirectsXmlParser.cs b/src/Geta.NotFoundHandler/Core/Redirects/RedirectsXmlParser.cs
@@ -33,9 +33,17 @@ public RedirectsXmlParser(ILogger<RedirectsXmlParser> logger)
         public CustomRedirectCollection LoadFromStream(Stream xmlContent)
         {
             _customRedirectsXmlFile = new XmlDocument();
+
             if (xmlContent != null)
             {
-                _customRedirectsXmlFile.Load(xmlContent);
+                var settings = new XmlReaderSettings
+                {
+                    DtdProcessing = DtdProcessing.Prohibit,
+                    XmlResolver = null
+                };
+
+                using var reader = XmlReader.Create(xmlContent, settings);
+                _customRedirectsXmlFile.Load(reader);
             }
             else
             {