Fixing XXE injection with XmlTextReader

Similar to XmlDocument, another fast, non-cached, forward-only parser to XML option is XmlTextReader. A major drawback of this high-performance parser is its lack of data validation. XmlTextReader also allows you to process DTDs by default, which can be a concern if your XML sources are untrusted.

This recipe will show you how to disable DTD processing with XmlTextReader.

Getting ready

Using Visual Studio Code, open the sample Online Banking app folder at \Chapter05\xxe-injection02\before\OnlineBankingApp\.

How to do it…

Let's take a look at the steps for this recipe:

1. From the starting exercise folder, launch Visual Studio Code by typing the following command:

   code .

2. Open the Services\KnowledgebaseService.cs file. This version of the OnlineBankingApp sample solution is using XmlTextReader to parse the Knowledgebase.xml file:

   XmlTextReader xmlReader = new XmlTextReader(file);
   xmlReader.DtdProcessing = DtdProcessing...