vetkit.csharp.xxe.url-resolver-enabled
An XmlUrlResolver is attached to an XML parser. With DTD processing on (the default for XmlDocument on .NET Framework before 4.5.2), external entities can read local files or make network requests (XXE).
Last updated:
Suite: Security
csharp
An XmlUrlResolver is attached to an XML parser. With DTD processing on (the default for XmlDocument on .NET Framework before 4.5.2), external entities can read local files or make network requests (XXE).
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Set XmlResolver = null (or an XmlSecureResolver with an empty permission set) before loading untrusted XML.
References
Source: packages/engine/rules/sast/csharp.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.