vetkit.csharp.xxe.xslt-script-or-document-enabled
XSLT embedded scripts or the document() function are enabled. A malicious stylesheet can then run code or read arbitrary files and URLs.
Last updated:
Suite: Security
csharp
XSLT embedded scripts or the document() function are enabled. A malicious stylesheet can then run code or read arbitrary files and URLs.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Use XsltSettings.Default (both disabled) and pass a null resolver unless the stylesheet is fully trusted.
References
Source: packages/engine/rules/sast/csharp.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.