From 51e416da34b697e577c673c1274b0a6b3d8a3235 Mon Sep 17 00:00:00 2001
From: AlinMoldovean <aam@softing.com>
Date: Wed, 30 May 2018 15:53:24 +0300
Subject: [PATCH] Fix for prevent downloading DTD references when decoding an
 XmlDocument.

---
 .../Types/Encoders/BinaryDecoder.cs           | 10 +++++-
 .../Opc.Ua.Core/Types/Encoders/JsonDecoder.cs |  9 ++++-
 .../Opc.Ua.Core/Types/Encoders/XmlDecoder.cs  | 35 +++++++++++++------
 3 files changed, 42 insertions(+), 12 deletions(-)

diff --git a/Stack/Opc.Ua.Core/Types/Encoders/BinaryDecoder.cs b/Stack/Opc.Ua.Core/Types/Encoders/BinaryDecoder.cs
index 5941ba39a2..43b2a9d2fa 100644
--- a/Stack/Opc.Ua.Core/Types/Encoders/BinaryDecoder.cs
+++ b/Stack/Opc.Ua.Core/Types/Encoders/BinaryDecoder.cs
@@ -498,14 +498,22 @@ namespace Opc.Ua
             }
 
             XmlDocument document = new XmlDocument();
+
             try
             {
-                document.InnerXml = new UTF8Encoding().GetString(bytes, 0, bytes.Length);
+                string xmlString = new UTF8Encoding().GetString(bytes, 0, bytes.Length);
+
+                using (XmlReader reader = XmlReader.Create(new StringReader(xmlString), new XmlReaderSettings()
+                    { DtdProcessing = System.Xml.DtdProcessing.Prohibit }))
+                {
+                    document.Load(reader);
+                }
             }
             catch (XmlException)
             {
                 return null;
             }
+
             return document.DocumentElement;
         }
 
diff --git a/Stack/Opc.Ua.Core/Types/Encoders/JsonDecoder.cs b/Stack/Opc.Ua.Core/Types/Encoders/JsonDecoder.cs
index e0d5f1b90d..0991f44e33 100644
--- a/Stack/Opc.Ua.Core/Types/Encoders/JsonDecoder.cs
+++ b/Stack/Opc.Ua.Core/Types/Encoders/JsonDecoder.cs
@@ -864,7 +864,14 @@ namespace Opc.Ua
             if (bytes != null && bytes.Length > 0)
             {
                 XmlDocument document = new XmlDocument();
-                document.InnerXml = new UTF8Encoding().GetString(bytes);
+                string xmlString = new UTF8Encoding().GetString(bytes, 0, bytes.Length);
+
+                using (XmlReader reader = XmlReader.Create(new StringReader(xmlString), new XmlReaderSettings()
+                    { DtdProcessing = System.Xml.DtdProcessing.Prohibit }))
+                {
+                    document.Load(reader);
+                }
+
                 return document.DocumentElement;
             }
 
diff --git a/Stack/Opc.Ua.Core/Types/Encoders/XmlDecoder.cs b/Stack/Opc.Ua.Core/Types/Encoders/XmlDecoder.cs
index 2e02d76caf..0deb4edf95 100644
--- a/Stack/Opc.Ua.Core/Types/Encoders/XmlDecoder.cs
+++ b/Stack/Opc.Ua.Core/Types/Encoders/XmlDecoder.cs
@@ -525,19 +525,19 @@ namespace Opc.Ua
                 m_namespaces.Pop();
             }
         }
-        
+
         /// <summary>
         /// Reads the body extension object from the stream.
         /// </summary>
         public object ReadExtensionObjectBody(ExpandedNodeId typeId)
         {            
             m_reader.MoveToContent();
-                                    
+
             // check for binary encoded body.
             if (m_reader.LocalName == "ByteString" && m_reader.NamespaceURI == Namespaces.OpcUaXsd)
             {
                 PushNamespace(Namespaces.OpcUaXsd);
-                byte[] bytes = ReadByteString("ByteString");       
+                byte[] bytes = ReadByteString("ByteString");
                 PopNamespace();
                 
                 return bytes;
@@ -545,10 +545,18 @@ namespace Opc.Ua
 
             // check for empty body.
             XmlDocument document = new XmlDocument();
+            string xmlString = null;
 
             if (m_reader.IsEmptyElement)
-            {        
-                document.InnerXml = m_reader.ReadOuterXml();                        
+            {
+                xmlString = m_reader.ReadOuterXml();
+
+                using (XmlReader reader = XmlReader.Create(new StringReader(xmlString), new XmlReaderSettings()
+                    { DtdProcessing = System.Xml.DtdProcessing.Prohibit }))
+                {
+                    document.Load(reader);
+                }
+
                 return document.DocumentElement;
             }
 
@@ -559,16 +567,23 @@ namespace Opc.Ua
 
             // decode known type.
             if (systemType != null)
-            {                      
+            {
                 PushNamespace(m_reader.NamespaceURI);
                 encodeable = ReadEncodeable(m_reader.LocalName, systemType);
                 PopNamespace();
-                                
+
                 return encodeable;
             }
-            
-            // return undecoded xml body.                 
-            document.InnerXml = m_reader.ReadOuterXml();                        
+
+            // return undecoded xml body.
+            xmlString = m_reader.ReadOuterXml();
+
+            using (XmlReader reader = XmlReader.Create(new StringReader(xmlString), new XmlReaderSettings()
+                { DtdProcessing = System.Xml.DtdProcessing.Prohibit }))
+            {
+                document.Load(reader);
+            }
+
             return document.DocumentElement;
         }
         #endregion