SDL | Changing ReadXml to a more secure overload. (dotnet#2147) (dotnet#2490)

dauinsight · JRahnama · dauinsight · commit c6bc5f3fc13c · 2024-05-16T15:41:56.000-07:00
Co-authored-by: Javad &lt;v-jarahn@microsoft.com&gt;
diff --git a/src/Microsoft.Data.SqlClient/src/Microsoft/Data/ProviderBase/DbMetaDataFactory.cs b/src/Microsoft.Data.SqlClient/src/Microsoft/Data/ProviderBase/DbMetaDataFactory.cs
@@ -9,6 +9,7 @@
 using System.Diagnostics;
 using System.Globalization;
 using System.IO;
+using System.Xml;
 
 namespace Microsoft.Data.ProviderBase
 {
@@ -499,9 +500,14 @@ private void LoadDataSetFromXml(Stream XmlStream)
         {
             _metaDataCollectionsDataSet = new DataSet
             {
-                Locale = System.Globalization.CultureInfo.InvariantCulture
+                Locale = CultureInfo.InvariantCulture
+            };
+            XmlReaderSettings settings = new()
+            {
+                XmlResolver = null
             };
-            _metaDataCollectionsDataSet.ReadXml(XmlStream);
+            using XmlReader reader = XmlReader.Create(XmlStream, settings);
+            _metaDataCollectionsDataSet.ReadXml(reader);
         }
 
         protected virtual DataTable PrepareCollection(string collectionName, string[] restrictions, DbConnection connection)

Original file line number	Diff line number	Diff line change
`@@ -9,6 +9,7 @@`
`9`	`9`	`using System.Diagnostics;`
`10`	`10`	`using System.Globalization;`
`11`	`11`	`using System.IO;`
	`12`	`+using System.Xml;`
`12`	`13`
`13`	`14`	`namespace Microsoft.Data.ProviderBase`
`14`	`15`	`{`
`@@ -499,9 +500,14 @@ private void LoadDataSetFromXml(Stream XmlStream)`
`499`	`500`	`{`
`500`	`501`	`_metaDataCollectionsDataSet = new DataSet`
`501`	`502`	`{`
`502`		`- Locale = System.Globalization.CultureInfo.InvariantCulture`
	`503`	`+ Locale = CultureInfo.InvariantCulture`
	`504`	`+ };`
	`505`	`+ XmlReaderSettings settings = new()`
	`506`	`+ {`
	`507`	`+ XmlResolver = null`
`503`	`508`	`};`
`504`		`- _metaDataCollectionsDataSet.ReadXml(XmlStream);`
	`509`	`+ using XmlReader reader = XmlReader.Create(XmlStream, settings);`
	`510`	`+ _metaDataCollectionsDataSet.ReadXml(reader);`
`505`	`511`	`}`
`506`	`512`
`507`	`513`	`protected virtual DataTable PrepareCollection(string collectionName, string[] restrictions, DbConnection connection)`