SDL | Changing ReadXml to a more secure overload. (#2147) (#2516)

dotnet · May 21, 2024 · 4db5b55 · 4db5b55
1 parent 77ec674
commit 4db5b55
Showing 1 changed file with 11 additions and 3 deletions.
diff --git a/...ft.Data.SqlClient/netcore/src/Common/src/Microsoft/Data/ProviderBase/DbMetaDataFactory.cs b/...ft.Data.SqlClient/netcore/src/Common/src/Microsoft/Data/ProviderBase/DbMetaDataFactory.cs
@@ -9,6 +9,7 @@
 using System.Diagnostics;
 using System.Globalization;
 using System.IO;
+using System.Xml;
 
 namespace Microsoft.Data.ProviderBase
 {
@@ -507,9 +508,16 @@ private bool IncludeThisColumn(DataColumn sourceColumn, string[] hiddenColumnNam
 
         private void LoadDataSetFromXml(Stream XmlStream)
         {
-            _metaDataCollectionsDataSet = new DataSet();
-            _metaDataCollectionsDataSet.Locale = System.Globalization.CultureInfo.InvariantCulture;
-            _metaDataCollectionsDataSet.ReadXml(XmlStream);
+            _metaDataCollectionsDataSet = new DataSet
+            {
+                Locale = CultureInfo.InvariantCulture
+            };
+            XmlReaderSettings settings = new()
+            {
+                XmlResolver = null
+            };
+            using XmlReader reader = XmlReader.Create(XmlStream, settings);
+            _metaDataCollectionsDataSet.ReadXml(reader);
         }
 
         protected virtual DataTable PrepareCollection(string collectionName, string[] restrictions, DbConnection connection)