XML Injection C#

Question

XmlDocument doc = new XmlDocument();
doc.LoadXml(template);
XmlElement list = doc.CreateElement(conn.XmlListTagName);
foreach (EaiItem updateItem in itemList)
{
    XmlElement item = doc.CreateElement( conn.XmlItemTagName );
    foreach(String itemAttrib in updateItem.ItemAttributes.Keys)
    {
        item.SetAttribute(itemAttrib, updateItem.ItemAttributes[itemAttrib]);
    }
    item.InnerXml = updateItem.ItemFieldXml;
    list.AppendChild(item);
}
doc.LastChild.AppendChild(list);

Fortify tool displaying the xml injection in the below code

 item.InnerXml = updateItem.ItemFieldXml;

How to prevent the xml injection issue ?

What is the problem? I assume ItemFieldXml contains XML that you want to insert into your document as a child XML fragment of your item element? or do you want it stored as CDATA? — Dai
– Dai, Commented Feb 27, 2017 at 19:33

CodexArcanum · Accepted Answer · 2019-10-30 20:13:47Z

1

If your ItemFieldXml should be stored as CDATA in your XML instead of as actual XML, then use XmlDocument.CreateCDataSection:

So instead of this:

item.InnerXml = updateItem.ItemFieldXml;
list.AppendChild( item );

Do this:

XmlCDataSection cdata = doc.CreateCDataSection( updatedItem.ItemFieldXml );
item.AppendChild( cdata );
list.AppendChild( item );

That will render as this:

<item>
<![CDATA[
<foo>embedded XML that is escaped!</foo>
]]>
</item>

The <foo> text will not be interpreted as actual XML by conforming XML parsers.

An alternative is to create a Text node where the angle-brackets will be converted to the XML entities <, >, and &. Using CDATA will be more efficient if you have many angle-brackets because it will require less space.

item.InnerText = updatedItem.ItemFieldXml;
list.AppendChild( item );

This will render as:

<item>
&lt;foo&gt;embedded XML that is escaped!&lt;/foo&gt;
</item>

edited Oct 30, 2019 at 20:13

CodexArcanum

4,0043 gold badges37 silver badges41 bronze badges

answered Feb 27, 2017 at 19:39

Dai

158k31 gold badges314 silver badges437 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

XML Injection C#

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related