.NET: What is the purpose of the ProhibitDtd property in XmlReaderSettings? Why is DTD a security i

Posted by Cheeso on Stack Overflow See other posts from Stack Overflow or by Cheeso
Published on 2010-03-31T20:20:09Z Indexed on 2010/03/31 20:23 UTC
Read the original article Hit count: 321

Filed under:

dtd

|

xmlreader

|

.NET

The documentation says:

When set to true, the XmlReader throws an XmlException when any DTD content is encountered. Do not enable DTD processing if you are concerned about Denial of Service issues or if you are dealing with untrusted sources.

If you have DTD processing enabled, you can use the XmlSecureResolver to restrict the resources that the XmlReader can access. You can also design your application so that the XML processing is memory and time constrained. For example, configure time-out limits in your ASP.NET application.

Can someone please explain the issue?

Why would a reader application want to prohibit the retrieval of a DTD? Where is the denial-of-service issue, if it is a reading application? What is the "trust" issue that is mentioned?

Thanks

© Stack Overflow or respective owner

Related posts about dtd

XML Catalog file failing to resolve

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm using an OASIS v 1.1 compatible resolver (Norm Walsh's XMLResolver in conjunction with the catalog below. However, I'm pretty sure I've made some sort of obvious error here (this is the first time I've needed to use v 1.1 features) since attempting to resolve OxChapML.dtd fails. Can anyone see… >>> More
Extending XHTML

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm playing around with writing a jQuery plugin that uses an attribute to define form validation behavior (yes, I'm aware there's already a validation plugin; this is as much a learning exercise as something I'll be using). Ideally, I'd like to have something like this: Example 1 - input: <input… >>> More
dtd vs xsd, which one to choose?

as seen on Stack Overflow - Search for 'Stack Overflow'
i want to use one of these to describe my xml document. i've read that xsd is better than the older dtd since it supports namespaces and data types. does this mean that i should only use xsd for all future needs and totally ignore dtd and don´t even have to bother learning its structure? >>> More
JiBX binding DTD schema in Eclipse

as seen on Stack Overflow - Search for 'Stack Overflow'
I have warnings in binding xml files: No grammar constraints (DTD or XML schema) detected for the document. I have done as is written in the answer here: http://stackoverflow.com/questions/982263/jibx-how-do-i-keep-using-interfaces-in-my-code (answer which is not accepted). But now I have an error… >>> More
php script to convert xml to dtd

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi all, Is there any PHP script to convert XML file to DTD. I tried a lot. I can able to find tools but can't PHP script. Is there any? any help will be thankful... Fero >>> More

Related posts about xmlreader

Parsing XML with the PHP XMLReader

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi Guys, I am writing program that reads in some XML from the $_POST variable and then parses using the PHP XMLReader and the data extracted input into a database. I am using the XMLReader as the XML supplied will more than likely be too big to place into memory. However I am having some issues… >>> More
Current line number from a System.Xml.XmlReader (C# & .Net)

as seen on Stack Overflow - Search for 'Stack Overflow'
Does anyone know how I can get the current line number of an System.Xml.XmlReader? I am trying to record where in a file I find Xml elements. >>> More
Reading Xml with XmlReader in C#

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to read the following Xml document as fast as I can and let additional classes manage the reading of each sub block. <ApplicationPool><Accounts><Account><NameOfKin></NameOfKin><StatementsAvailable><Statement></Statement></StatementsAvailable></Account></Accounts></ApplicationPool> I… >>> More
System.ServiceModel.Syndication.SyndicationFeed throws when the RSS document includes a <script> blo

as seen on Stack Overflow - Search for 'Stack Overflow'
The code: using (XmlReader xmlr = XmlReader.Create(new StringReader(allXml))) { var items = from item in SyndicationFeed.Load(xmlr).Items select item; } The exception: Exception: System.Xml.XmlException: Unexpected node type Element. ReadElementString method can only be called… >>> More
XmlReader throws on an RSS feed, when the RSS document includes an embedded <script> block.

as seen on Stack Overflow - Search for 'Stack Overflow'
The code: using (XmlReader xmlr = XmlReader.Create(new StringReader(allXml))) { var items = from item in SyndicationFeed.Load(xmlr).Items select item; } The exception: Exception: System.Xml.XmlException: Unexpected node type Element. ReadElementString method can only be called… >>> More