XML documents can contain Document Type Definitions (DTDs), which may define new XML entities. These can be used to perform Denial of Service (DoS) attacks, or resolve to resources outside the intended sphere of control.

When processing XML documents, ensure that DTD processing is disabled unless absolutely necessary, and if it is necessary, ensure that a secure resolver is used.

The following example shows an HTTP request parameter being read directly into an XmlTextReader. In the current version of the .NET Framework, XmlTextReader has DTD processing enabled by default.

The solution is to set the DtdProcessing property to DtdProcessing.Prohibit.

  • OWASP: XML External Entity (XXE) Prevention Cheat Sheet.
  • Microsoft Docs: System.XML: Security considerations.