diff options
6 files changed, 37 insertions, 9 deletions
diff --git a/src/DotNetOpenAuth.AspNet/Clients/OAuth/OAuthClient.cs b/src/DotNetOpenAuth.AspNet/Clients/OAuth/OAuthClient.cs index 9a9f40d..1ae64fc 100644 --- a/src/DotNetOpenAuth.AspNet/Clients/OAuth/OAuthClient.cs +++ b/src/DotNetOpenAuth.AspNet/Clients/OAuth/OAuthClient.cs @@ -164,9 +164,8 @@ namespace DotNetOpenAuth.AspNet.Clients { internal static XDocument LoadXDocumentFromStream(Stream stream) { const int MaxChars = 0x10000; // 64k - XmlReaderSettings settings = new XmlReaderSettings() { - MaxCharactersInDocument = MaxChars - }; + var settings = MessagingUtilities.CreateUntrustedXmlReaderSettings(); + settings.MaxCharactersInDocument = MaxChars; return XDocument.Load(XmlReader.Create(stream, settings)); } diff --git a/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs b/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs index b26deeb..084403a 100644 --- a/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs +++ b/src/DotNetOpenAuth.Core/Messaging/MessagingUtilities.cs @@ -21,6 +21,7 @@ namespace DotNetOpenAuth.Messaging { using System.Text; using System.Web; using System.Web.Mvc; + using System.Xml; using DotNetOpenAuth.Messaging.Bindings; using DotNetOpenAuth.Messaging.Reflection; @@ -290,6 +291,28 @@ namespace DotNetOpenAuth.Messaging { } /// <summary> + /// Creates the XML reader settings to use for reading XML from untrusted sources. + /// </summary> + /// <returns> + /// The new instance of <see cref="XmlReaderSettings"/>. + /// </returns> + /// <remarks> + /// The default values set here are based on recommendations from + /// http://msdn.microsoft.com/en-us/magazine/ee335713.aspx + /// </remarks> + internal static XmlReaderSettings CreateUntrustedXmlReaderSettings() { + return new XmlReaderSettings { + MaxCharactersFromEntities = 1024, + XmlResolver = null, +#if CLR4 + DtdProcessing = DtdProcessing.Prohibit, +#else + ProhibitDtd = true, +#endif + }; + } + + /// <summary> /// Clears any existing elements in a collection and fills the collection with a given set of values. /// </summary> /// <typeparam name="T">The type of value kept in the collection.</typeparam> diff --git a/src/DotNetOpenAuth.InfoCard/InfoCard/Token/Token.cs b/src/DotNetOpenAuth.InfoCard/InfoCard/Token/Token.cs index 5526bfd..0660ec7 100644 --- a/src/DotNetOpenAuth.InfoCard/InfoCard/Token/Token.cs +++ b/src/DotNetOpenAuth.InfoCard/InfoCard/Token/Token.cs @@ -51,7 +51,8 @@ namespace DotNetOpenAuth.InfoCard { string decryptedString; using (StringReader xmlReader = new StringReader(tokenXml)) { - using (XmlReader tokenReader = XmlReader.Create(xmlReader)) { + var readerSettings = MessagingUtilities.CreateUntrustedXmlReaderSettings(); + using (XmlReader tokenReader = XmlReader.Create(xmlReader, readerSettings)) { Contract.Assume(tokenReader != null); // BCL contract should say XmlReader.Create result != null if (IsEncrypted(tokenReader)) { Logger.InfoCard.DebugFormat("Incoming SAML token, before decryption: {0}", tokenXml); @@ -206,7 +207,8 @@ namespace DotNetOpenAuth.InfoCard { var stringReader = new StringReader(tokenXml); XmlReader tokenReader; try { - tokenReader = XmlReader.Create(stringReader); + var readerSettings = MessagingUtilities.CreateUntrustedXmlReaderSettings(); + tokenReader = XmlReader.Create(stringReader, readerSettings); } catch { stringReader.Dispose(); throw; diff --git a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/HostMetaDiscoveryService.cs b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/HostMetaDiscoveryService.cs index 450f9e0..ffd2478 100644 --- a/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/HostMetaDiscoveryService.cs +++ b/src/DotNetOpenAuth.OpenId.RelyingParty/OpenId/HostMetaDiscoveryService.cs @@ -113,7 +113,8 @@ namespace DotNetOpenAuth.OpenId { using (var response = GetXrdsResponse(uriIdentifier, requestHandler, out signingHost)) { if (response != null) { try { - var document = new XrdsDocument(XmlReader.Create(response.ResponseStream)); + var readerSettings = MessagingUtilities.CreateUntrustedXmlReaderSettings(); + var document = new XrdsDocument(XmlReader.Create(response.ResponseStream, readerSettings)); ValidateXmlDSig(document, uriIdentifier, response, signingHost); var xrds = GetXrdElements(document, uriIdentifier.Uri.Host); @@ -189,7 +190,8 @@ namespace DotNetOpenAuth.OpenId { string nextAuthority = nextAuthorityNode != null ? nextAuthorityNode.Value.Trim() : identifier.Uri.Host; try { using (var externalXrdsResponse = GetXrdsResponse(identifier, requestHandler, externalLocation)) { - XrdsDocument externalXrds = new XrdsDocument(XmlReader.Create(externalXrdsResponse.ResponseStream)); + var readerSettings = MessagingUtilities.CreateUntrustedXmlReaderSettings(); + XrdsDocument externalXrds = new XrdsDocument(XmlReader.Create(externalXrdsResponse.ResponseStream, readerSettings)); ValidateXmlDSig(externalXrds, identifier, externalXrdsResponse, nextAuthority); results.AddRange(GetXrdElements(externalXrds, identifier).CreateServiceEndpoints(identifier, identifier)); } diff --git a/src/DotNetOpenAuth.OpenId/OpenId/XriDiscoveryProxyService.cs b/src/DotNetOpenAuth.OpenId/OpenId/XriDiscoveryProxyService.cs index 8265c75..3189a5d 100644 --- a/src/DotNetOpenAuth.OpenId/OpenId/XriDiscoveryProxyService.cs +++ b/src/DotNetOpenAuth.OpenId/OpenId/XriDiscoveryProxyService.cs @@ -77,7 +77,8 @@ namespace DotNetOpenAuth.OpenId { Contract.Ensures(Contract.Result<XrdsDocument>() != null); XrdsDocument doc; using (var xrdsResponse = Yadis.Request(requestHandler, GetXrdsUrl(identifier), identifier.IsDiscoverySecureEndToEnd)) { - doc = new XrdsDocument(XmlReader.Create(xrdsResponse.ResponseStream)); + var readerSettings = MessagingUtilities.CreateUntrustedXmlReaderSettings(); + doc = new XrdsDocument(XmlReader.Create(xrdsResponse.ResponseStream, readerSettings)); } ErrorUtilities.VerifyProtocol(doc.IsXrdResolutionSuccessful, OpenIdStrings.XriResolutionFailed); return doc; diff --git a/src/DotNetOpenAuth.OpenId/Yadis/Yadis.cs b/src/DotNetOpenAuth.OpenId/Yadis/Yadis.cs index f71ad46..a23e019 100644 --- a/src/DotNetOpenAuth.OpenId/Yadis/Yadis.cs +++ b/src/DotNetOpenAuth.OpenId/Yadis/Yadis.cs @@ -190,7 +190,8 @@ namespace DotNetOpenAuth.Yadis { if (response.ContentType.MediaType == ContentTypes.Xml) { // This COULD be an XRDS document with an imprecise content-type. response.ResponseStream.Seek(0, SeekOrigin.Begin); - XmlReader reader = XmlReader.Create(response.ResponseStream); + var readerSettings = MessagingUtilities.CreateUntrustedXmlReaderSettings(); + XmlReader reader = XmlReader.Create(response.ResponseStream, readerSettings); while (reader.Read() && reader.NodeType != XmlNodeType.Element) { // intentionally blank } |