Skip to content

Commit 6c4b503

Browse files
dsymedsyme
authored
Revert "Potential XXE vulnerability fix on XML-parsing" (#1633)
1 parent cf14933 commit 6c4b503

10 files changed

+138
-72
lines changed

‎src/AssemblyInfo.Csv.Core.fs‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3+
34
open System.Reflection
45

56
[<assembly: AssemblyTitleAttribute("FSharp.Data.Csv.Core")>]
@@ -10,8 +11,17 @@ open System.Reflection
1011
do ()
1112

1213
module internal AssemblyVersionInformation =
13-
let [<Literal>] AssemblyTitle = "FSharp.Data.Csv.Core"
14-
let [<Literal>] AssemblyProduct = "FSharp.Data"
15-
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16-
let [<Literal>] AssemblyVersion = "6.6.0.0"
17-
let [<Literal>] AssemblyFileVersion = "6.6.0.0"
14+
[<Literal>]
15+
let AssemblyTitle = "FSharp.Data.Csv.Core"
16+
17+
[<Literal>]
18+
let AssemblyProduct = "FSharp.Data"
19+
20+
[<Literal>]
21+
let AssemblyDescription = "Library of F# type providers and data access tools"
22+
23+
[<Literal>]
24+
let AssemblyVersion = "6.6.0.0"
25+
26+
[<Literal>]
27+
let AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.DesignTime.fs‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3+
34
open System.Reflection
45

56
[<assembly: AssemblyTitleAttribute("FSharp.Data.DesignTime")>]
@@ -10,8 +11,17 @@ open System.Reflection
1011
do ()
1112

1213
module internal AssemblyVersionInformation =
13-
let [<Literal>] AssemblyTitle = "FSharp.Data.DesignTime"
14-
let [<Literal>] AssemblyProduct = "FSharp.Data"
15-
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16-
let [<Literal>] AssemblyVersion = "6.6.0.0"
17-
let [<Literal>] AssemblyFileVersion = "6.6.0.0"
14+
[<Literal>]
15+
let AssemblyTitle = "FSharp.Data.DesignTime"
16+
17+
[<Literal>]
18+
let AssemblyProduct = "FSharp.Data"
19+
20+
[<Literal>]
21+
let AssemblyDescription = "Library of F# type providers and data access tools"
22+
23+
[<Literal>]
24+
let AssemblyVersion = "6.6.0.0"
25+
26+
[<Literal>]
27+
let AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.Html.Core.fs‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3+
34
open System.Reflection
45

56
[<assembly: AssemblyTitleAttribute("FSharp.Data.Html.Core")>]
@@ -10,8 +11,17 @@ open System.Reflection
1011
do ()
1112

1213
module internal AssemblyVersionInformation =
13-
let [<Literal>] AssemblyTitle = "FSharp.Data.Html.Core"
14-
let [<Literal>] AssemblyProduct = "FSharp.Data"
15-
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16-
let [<Literal>] AssemblyVersion = "6.6.0.0"
17-
let [<Literal>] AssemblyFileVersion = "6.6.0.0"
14+
[<Literal>]
15+
let AssemblyTitle = "FSharp.Data.Html.Core"
16+
17+
[<Literal>]
18+
let AssemblyProduct = "FSharp.Data"
19+
20+
[<Literal>]
21+
let AssemblyDescription = "Library of F# type providers and data access tools"
22+
23+
[<Literal>]
24+
let AssemblyVersion = "6.6.0.0"
25+
26+
[<Literal>]
27+
let AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.Http.fs‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3+
34
open System.Reflection
45

56
[<assembly: AssemblyTitleAttribute("FSharp.Data.Http")>]
@@ -10,8 +11,17 @@ open System.Reflection
1011
do ()
1112

1213
module internal AssemblyVersionInformation =
13-
let [<Literal>] AssemblyTitle = "FSharp.Data.Http"
14-
let [<Literal>] AssemblyProduct = "FSharp.Data"
15-
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16-
let [<Literal>] AssemblyVersion = "6.6.0.0"
17-
let [<Literal>] AssemblyFileVersion = "6.6.0.0"
14+
[<Literal>]
15+
let AssemblyTitle = "FSharp.Data.Http"
16+
17+
[<Literal>]
18+
let AssemblyProduct = "FSharp.Data"
19+
20+
[<Literal>]
21+
let AssemblyDescription = "Library of F# type providers and data access tools"
22+
23+
[<Literal>]
24+
let AssemblyVersion = "6.6.0.0"
25+
26+
[<Literal>]
27+
let AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.Json.Core.fs‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3+
34
open System.Reflection
45

56
[<assembly: AssemblyTitleAttribute("FSharp.Data.Json.Core")>]
@@ -10,8 +11,17 @@ open System.Reflection
1011
do ()
1112

1213
module internal AssemblyVersionInformation =
13-
let [<Literal>] AssemblyTitle = "FSharp.Data.Json.Core"
14-
let [<Literal>] AssemblyProduct = "FSharp.Data"
15-
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16-
let [<Literal>] AssemblyVersion = "6.6.0.0"
17-
let [<Literal>] AssemblyFileVersion = "6.6.0.0"
14+
[<Literal>]
15+
let AssemblyTitle = "FSharp.Data.Json.Core"
16+
17+
[<Literal>]
18+
let AssemblyProduct = "FSharp.Data"
19+
20+
[<Literal>]
21+
let AssemblyDescription = "Library of F# type providers and data access tools"
22+
23+
[<Literal>]
24+
let AssemblyVersion = "6.6.0.0"
25+
26+
[<Literal>]
27+
let AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.Runtime.Utilities.fs‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3+
34
open System.Reflection
45

56
[<assembly: AssemblyTitleAttribute("FSharp.Data.Runtime.Utilities")>]
@@ -10,8 +11,17 @@ open System.Reflection
1011
do ()
1112

1213
module internal AssemblyVersionInformation =
13-
let [<Literal>] AssemblyTitle = "FSharp.Data.Runtime.Utilities"
14-
let [<Literal>] AssemblyProduct = "FSharp.Data"
15-
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16-
let [<Literal>] AssemblyVersion = "6.6.0.0"
17-
let [<Literal>] AssemblyFileVersion = "6.6.0.0"
14+
[<Literal>]
15+
let AssemblyTitle = "FSharp.Data.Runtime.Utilities"
16+
17+
[<Literal>]
18+
let AssemblyProduct = "FSharp.Data"
19+
20+
[<Literal>]
21+
let AssemblyDescription = "Library of F# type providers and data access tools"
22+
23+
[<Literal>]
24+
let AssemblyVersion = "6.6.0.0"
25+
26+
[<Literal>]
27+
let AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.WorldBank.Core.fs‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3+
34
open System.Reflection
45

56
[<assembly: AssemblyTitleAttribute("FSharp.Data.WorldBank.Core")>]
@@ -10,8 +11,17 @@ open System.Reflection
1011
do ()
1112

1213
module internal AssemblyVersionInformation =
13-
let [<Literal>] AssemblyTitle = "FSharp.Data.WorldBank.Core"
14-
let [<Literal>] AssemblyProduct = "FSharp.Data"
15-
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16-
let [<Literal>] AssemblyVersion = "6.6.0.0"
17-
let [<Literal>] AssemblyFileVersion = "6.6.0.0"
14+
[<Literal>]
15+
let AssemblyTitle = "FSharp.Data.WorldBank.Core"
16+
17+
[<Literal>]
18+
let AssemblyProduct = "FSharp.Data"
19+
20+
[<Literal>]
21+
let AssemblyDescription = "Library of F# type providers and data access tools"
22+
23+
[<Literal>]
24+
let AssemblyVersion = "6.6.0.0"
25+
26+
[<Literal>]
27+
let AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.Xml.Core.fs‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3+
34
open System.Reflection
45

56
[<assembly: AssemblyTitleAttribute("FSharp.Data.Xml.Core")>]
@@ -10,8 +11,17 @@ open System.Reflection
1011
do ()
1112

1213
module internal AssemblyVersionInformation =
13-
let [<Literal>] AssemblyTitle = "FSharp.Data.Xml.Core"
14-
let [<Literal>] AssemblyProduct = "FSharp.Data"
15-
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16-
let [<Literal>] AssemblyVersion = "6.6.0.0"
17-
let [<Literal>] AssemblyFileVersion = "6.6.0.0"
14+
[<Literal>]
15+
let AssemblyTitle = "FSharp.Data.Xml.Core"
16+
17+
[<Literal>]
18+
let AssemblyProduct = "FSharp.Data"
19+
20+
[<Literal>]
21+
let AssemblyDescription = "Library of F# type providers and data access tools"
22+
23+
[<Literal>]
24+
let AssemblyVersion = "6.6.0.0"
25+
26+
[<Literal>]
27+
let AssemblyFileVersion = "6.6.0.0"

‎src/AssemblyInfo.fs‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
// Auto-Generated by FAKE; do not edit
22
namespace System
3+
34
open System.Reflection
45

56
[<assembly: AssemblyTitleAttribute("FSharp.Data")>]
@@ -10,8 +11,17 @@ open System.Reflection
1011
do ()
1112

1213
module internal AssemblyVersionInformation =
13-
let [<Literal>] AssemblyTitle = "FSharp.Data"
14-
let [<Literal>] AssemblyProduct = "FSharp.Data"
15-
let [<Literal>] AssemblyDescription = "Library of F# type providers and data access tools"
16-
let [<Literal>] AssemblyVersion = "6.6.0.0"
17-
let [<Literal>] AssemblyFileVersion = "6.6.0.0"
14+
[<Literal>]
15+
let AssemblyTitle = "FSharp.Data"
16+
17+
[<Literal>]
18+
let AssemblyProduct = "FSharp.Data"
19+
20+
[<Literal>]
21+
let AssemblyDescription = "Library of F# type providers and data access tools"
22+
23+
[<Literal>]
24+
let AssemblyVersion = "6.6.0.0"
25+
26+
[<Literal>]
27+
let AssemblyFileVersion = "6.6.0.0"

‎src/FSharp.Data.Xml.Core/XmlRuntime.fs‎

Lines changed: 3 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ namespace FSharp.Data.Runtime.BaseTypes
66

77
open System.ComponentModel
88
open System.IO
9-
open System.Xml
109
open System.Xml.Linq
1110

1211
#nowarn "10001"
@@ -57,16 +56,7 @@ type XmlElement =
5756
IsError = false)>]
5857
static member Create(reader: TextReader) =
5958
use reader = reader
60-
// Secure XML parsing: disable DTD processing and external entities to prevent XXE attacks
61-
let xmlReaderSettings =
62-
new XmlReaderSettings(
63-
DtdProcessing = DtdProcessing.Prohibit,
64-
XmlResolver = null,
65-
MaxCharactersFromEntities = 1024L * 1024L
66-
) // 1MB limit
67-
68-
use xmlReader = XmlReader.Create(reader, xmlReaderSettings)
69-
let element = XDocument.Load(xmlReader, LoadOptions.PreserveWhitespace).Root
59+
let element = XDocument.Load(reader, LoadOptions.PreserveWhitespace).Root
7060
{ XElement = element }
7161

7262
/// <exclude />
@@ -79,26 +69,12 @@ type XmlElement =
7969
use reader = reader
8070
let text = reader.ReadToEnd()
8171

82-
// Secure XML parsing: disable DTD processing and external entities to prevent XXE attacks
83-
let xmlReaderSettings =
84-
new XmlReaderSettings(
85-
DtdProcessing = DtdProcessing.Prohibit,
86-
XmlResolver = null,
87-
MaxCharactersFromEntities = 1024L * 1024L
88-
) // 1MB limit
89-
9072
try
91-
use stringReader = new StringReader(text)
92-
use xmlReader = XmlReader.Create(stringReader, xmlReaderSettings)
93-
94-
XDocument.Load(xmlReader, LoadOptions.PreserveWhitespace).Root.Elements()
73+
XDocument.Parse(text, LoadOptions.PreserveWhitespace).Root.Elements()
9574
|> Seq.map (fun value -> { XElement = value })
9675
|> Seq.toArray
9776
with _ when text.TrimStart().StartsWith "<" ->
98-
use stringReader = new StringReader("<root>" + text + "</root>")
99-
use xmlReader = XmlReader.Create(stringReader, xmlReaderSettings)
100-
101-
XDocument.Load(xmlReader, LoadOptions.PreserveWhitespace).Root.Elements()
77+
XDocument.Parse("<root>" + text + "</root>", LoadOptions.PreserveWhitespace).Root.Elements()
10278
|> Seq.map (fun value -> { XElement = value })
10379
|> Seq.toArray
10480

0 commit comments

Comments
 (0)