ALee665277 (Community Member) asked a question.
Why is XmlPreloadedResolver.ResolveUri(Uri, String) Method generating an XXE flaw?
The method call XmlPreloadedResolver.ResolveUri(Uri, String) returns the Uri given the input values. This is Uri object, why would this be considered an "Improper Restriction of XML External Entity" CWE ID 611. The function is not accessing the XML information, it creates a Uri.
.png){kind=logo}
Hi @ALee665277 (Community Member) ,
The .NET ResolveUri method resolves relative file paths to absolute paths which may cause information leakage and is typically used to determine paths to load, see also excellent research done by VSR now NCCGroup: https://research.nccgroup.com/2014/05/19/xml-schema-dtd-and-entity-attacks-a-compendium-of-known-techniques/ .
Could you say more about how you're using this API in a context that would not result in XXE?
Thank you,
Boy Baukema
Thanks for the response. Yes, you have methods to restrict/prevent the reading and writing of your XML. This is what you want to prevent from a security stand point. But determining the path of your XML file may not be even related to reading or writing the XML file. You can use this method to show the possible location of the XML file which has nothing to do with reading/writing.
Hi @ALee665277 (Community Member) ,
While it is grouped with XXE this this might be better classified under CWE-201: Insertion of Sensitive Information Into Sent Data.
Please consider registering your idea with Veracode Community Ideas at https://community.veracode.com/s/ideas
Thank you,
Boy Baukema