GithubStar/UA-.NETStandard
1
0
Fork 0
mirror of https://github.com/OPCFoundation/UA-.NETStandard.git synced 2026-10-27 21:55:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #457 from AlinMoldovean/master

Browse Source 
Prevent DTD references when decoding XmlDocument
This commit is contained in:
Alin Moldovean
2018-05-31 15:44:11 +03:00
committed by GitHub
parent c8ee59a40e 51e416da34
commit 400a49aa0e
3 changed files with 42 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Stack/Opc.Ua.Core/Types/Encoders/BinaryDecoder.cs
+9 -1
View File
@@ -498,14 +498,22 @@ namespace Opc.Ua
}
XmlDocument document = new XmlDocument();
try
{
document.InnerXml = new UTF8Encoding().GetString(bytes, 0, bytes.Length);
string xmlString = new UTF8Encoding().GetString(bytes, 0, bytes.Length);
using (XmlReader reader = XmlReader.Create(new StringReader(xmlString), new XmlReaderSettings()
{ DtdProcessing = System.Xml.DtdProcessing.Prohibit }))
{
document.Load(reader);
}
}
catch (XmlException)
{
return null;
}
return document.DocumentElement;
}
Stack/Opc.Ua.Core/Types/Encoders/JsonDecoder.cs
+8 -1
View File
@@ -864,7 +864,14 @@ namespace Opc.Ua
if (bytes != null && bytes.Length > 0)
{
XmlDocument document = new XmlDocument();
document.InnerXml = new UTF8Encoding().GetString(bytes);
string xmlString = new UTF8Encoding().GetString(bytes, 0, bytes.Length);
using (XmlReader reader = XmlReader.Create(new StringReader(xmlString), new XmlReaderSettings()
{ DtdProcessing = System.Xml.DtdProcessing.Prohibit }))
{
document.Load(reader);
}
return document.DocumentElement;
}
Stack/Opc.Ua.Core/Types/Encoders/XmlDecoder.cs
+25 -10
View File
@@ -525,19 +525,19 @@ namespace Opc.Ua
m_namespaces.Pop();
}
}
/// <summary>
/// Reads the body extension object from the stream.
/// </summary>
public object ReadExtensionObjectBody(ExpandedNodeId typeId)
{
m_reader.MoveToContent();
// check for binary encoded body.
if (m_reader.LocalName == "ByteString" && m_reader.NamespaceURI == Namespaces.OpcUaXsd)
{
PushNamespace(Namespaces.OpcUaXsd);
byte[] bytes = ReadByteString("ByteString");
byte[] bytes = ReadByteString("ByteString");
PopNamespace();
return bytes;
@@ -545,10 +545,18 @@ namespace Opc.Ua
// check for empty body.
XmlDocument document = new XmlDocument();
string xmlString = null;
if (m_reader.IsEmptyElement)
{
document.InnerXml = m_reader.ReadOuterXml();
{
xmlString = m_reader.ReadOuterXml();
using (XmlReader reader = XmlReader.Create(new StringReader(xmlString), new XmlReaderSettings()
{ DtdProcessing = System.Xml.DtdProcessing.Prohibit }))
{
document.Load(reader);
}
return document.DocumentElement;
}
@@ -559,16 +567,23 @@ namespace Opc.Ua
// decode known type.
if (systemType != null)
{
{
PushNamespace(m_reader.NamespaceURI);
encodeable = ReadEncodeable(m_reader.LocalName, systemType);
PopNamespace();
return encodeable;
}
// return undecoded xml body.
document.InnerXml = m_reader.ReadOuterXml();
// return undecoded xml body.
xmlString = m_reader.ReadOuterXml();
using (XmlReader reader = XmlReader.Create(new StringReader(xmlString), new XmlReaderSettings()
{ DtdProcessing = System.Xml.DtdProcessing.Prohibit }))
{
document.Load(reader);
}
return document.DocumentElement;
}
#endregion