Merge pull request #153 from Geta/disable-dtd-processing-for-xml-import

Disable DTD processing for XML parser
Geta · Dec 9, 2024 · b113e3e · b113e3e
2 parents a80cc6d + a2e7987
commit b113e3e
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/src/Geta.NotFoundHandler/Core/Redirects/RedirectsXmlParser.cs b/src/Geta.NotFoundHandler/Core/Redirects/RedirectsXmlParser.cs
@@ -33,9 +33,17 @@ public RedirectsXmlParser(ILogger<RedirectsXmlParser> logger)
         public CustomRedirectCollection LoadFromStream(Stream xmlContent)
         {
             _customRedirectsXmlFile = new XmlDocument();
+
             if (xmlContent != null)
             {
-                _customRedirectsXmlFile.Load(xmlContent);
+                var settings = new XmlReaderSettings
+                {
+                    DtdProcessing = DtdProcessing.Prohibit,
+                    XmlResolver = null
+                };
+
+                using var reader = XmlReader.Create(xmlContent, settings);
+                _customRedirectsXmlFile.Load(reader);
             }
             else
             {