Skip to content

XmlDocument DOM docs: note XmlResolver=null for untrusted XML #55982

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
krwq wants to merge 1 commit into
base: main
Choose a base branch
from
+6 −0
Open

XmlDocument DOM docs: note XmlResolver=null for untrusted XML #55982

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/standard/data/xml/reading-an-xml-document-into-the-dom.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,9 @@ XML information is read into memory from different formats. It can be read from

The <xref:System.Xml.XmlDocument.Load*> method brings the document into memory and has overloaded methods available to take data from each of the different formats. There is also a <xref:System.Xml.XmlDocument.LoadXml*> method that reads XML from a string.

> [!IMPORTANT]
> When the XML is from an untrusted source, set <xref:System.Xml.XmlDocument.XmlResolver?displayProperty=nameWithType> to `null` before calling <xref:System.Xml.XmlDocument.Load*> or <xref:System.Xml.XmlDocument.LoadXml*> so that external document type definitions (DTDs), entities, and schemas are not resolved. For more information, see [CA3075: Insecure DTD processing](../../../fundamentals/code-analysis/quality-rules/ca3075.md).

@krwq krwq Sep 16, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note

This response was generated by AI.

Correct. CA3075's Violation 3 flags XmlDocument { XmlResolver = null }; doc.LoadXml(xml) and its solution wraps the input in an XmlReader created with XmlReaderSettings.XmlResolver = null; Load(XmlReader) also honors the reader's resolver over the document's (the table further down in resolving-external-resources.md already spells that out). I'll narrow the callout so it recommends the reader-based fix for LoadXml and Load(XmlReader), and keep XmlDocument.XmlResolver guidance scoped to the stream/string/URI overloads.


Different <xref:System.Xml.XmlDocument.Load*> methods affect which nodes are created when the XML Document Object Model (DOM) is loaded. The following table lists the differences between some of the <xref:System.Xml.XmlDocument.Load*> methods and topics that address them.

|Subject|Topic|
Expand Down
3 changes: 3 additions & 0 deletions docs/standard/data/xml/resolving-external-resources.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ ms.assetid: ad3fa320-4b8f-4e5c-b549-01157591007a

The **XmlResolver** property of the **XmlDocument** is used by the **XmlDocument** class to locate resources that are not inline in the XML data, such as external document type definitions (DTDs), entities, and schemas. These items can be located on a network or on a local drive, and are identifiable by a Uniform Resource Identifier (URI). This allows the **XmlDocument** to resolve **EntityReference** nodes that are present in the document and validate the document according to the external DTD or schema.

> [!IMPORTANT]
> When the input XML comes from an untrusted source, do not allow the **XmlDocument** to open external resources. Set the **XmlResolver** property to `null`, or supply an <xref:System.Xml.XmlSecureResolver> that restricts which resources can be accessed. For more information, see [CA3075: Insecure DTD processing](../../../fundamentals/code-analysis/quality-rules/ca3075.md).

@krwq krwq Sep 16, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note

This response was generated by AI.

Agreed - the existing table in this same file states that XmlDocument.Resolver cannot override the reader's resolver, so the blanket XmlResolver = null sentence is wrong for the reader-based overloads. Will scope the callout to the non-reader overloads and add XmlReaderSettings.XmlResolver = null (or XmlResolver.ThrowingResolver) as the fix for reader-based loading.

@krwq krwq Sep 16, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note

This response was generated by AI.

Confirmed - XmlSecureResolver is SYSLIB0047 since .NET 7, and XmlReader.xml already routes readers to XmlResolver.ThrowingResolver. Will drop XmlSecureResolver from the recommendation and use null or XmlResolver.ThrowingResolver to match the existing sibling docs.


## Fully-Trusted XmlDocument

The **XmlResolver** property affects the functionality of the **XmlDocument.Load** method. The table below shows how the **XmlDocument.XmlResolver** property works when the **XmlDocument** object is fully trusted. The following table shows the **XmlDocument.Load** methods when the input to the Load is a **TextReader**, **String**, **Stream**, or **URI**. This table does not apply to the **Load** method if the **XmlDocument** is loaded from an **XmlReader**.
Expand Down
Loading