Fixed XXE vulnerability when importing a new blog

sempf · May 5, 2022 · 16343de · 16343de
1 parent 4033c72
commit 16343de
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/BlogEngine/BlogEngine.Core/Services/Syndication/BlogML/BlogReader.cs b/BlogEngine/BlogEngine.Core/Services/Syndication/BlogML/BlogReader.cs
@@ -53,13 +53,15 @@ public string XmlData
         /// <summary>
         ///     Gets an XmlReader that converts BlogML data saved as string into XML stream
         /// </summary>
-        private XmlTextReader XmlReader
+        private XmlReader XmlReader
         {
             get
             {
                 var byteArray = Encoding.UTF8.GetBytes(this.xmlData);
                 var stream = new MemoryStream(byteArray);
-                return new XmlTextReader(stream);
+                XmlReaderSettings settings = new XmlReaderSettings();
+                settings.XmlResolver = null;
+                return XmlReader.Create(stream, settings);
             }
         }