Prevent DTD download when parsing XML

Question

When using XmlDocument.Load , I am finding that if the document refers to a DTD, a connection is made to the provided URI. Is there any way to prevent this from happening?

Answer 1

Use an XMLReader to load the document and set the ValidationType property of the reader settings to None.

Answer 2

Try something like this:

XmlDocument doc = new XmlDocument();
using (StringReader sr = new StringReader(xml))
  using (XmlReader reader = XmlReader.Create(sr, new XmlReaderSettings()))
  {
     doc.Load(reader);
  }

The thing to note here is that XmlReaderSettings has the ProhibitDtd property set to true by default.

Answer 3

The document being loaded HAS a DTD.

With:

settings.ProhibitDtd = true;

I see the following exception:

Service cannot be started. System.Xml.XmlException: For security reasons DTD is prohibited in this XML document. To enable DTD processing set the ProhibitDtd property on XmlReaderSettings to false and pass the settings into XmlReader.Create method.

So, it looks like ProhibitDtd MUST be set to true in this instance.

It looked like ValidationType would do the trick, but with:

settings.ValidationType = ValidationType.None;

I'm still seeing a connection to the DTD uri.

Answer 4

After some more digging, maybe you should set the XmlResolver property of the XmlReaderSettings object to null.

'The XmlResolver is used to locate and open an XML instance document, or to locate and open any external resources referenced by the XML instance document. This can include entities, DTD, or schemas.'

So the code would look like this:

        XmlReaderSettings settings = new XmlReaderSettings();
        settings.XmlResolver = null;
        XmlDocument doc = new XmlDocument();
        using (StringReader sr = new StringReader(xml))
            using (XmlReader reader = XmlReader.Create(sr, settings))
            {
                doc.Load(reader);
            }