XML entities in Json.NET

Question

Json.NET support converting JSON to and from XML. So I tried simple code like this:

string xml = @"<?xml version='1.0' standalone='no'?>
    <!DOCTYPE notes [
        <!ENTITY ent 'Sample text'>
    ]>
    <notes>
        <note>&ent;</note>
    </notes>";

XmlDocument doc = new XmlDocument();
doc.LoadXml(xml);
string json = JsonConvert.SerializeXmlNode(doc);
Console.WriteLine(json);

As a result there is thrown exception:

Newtonsoft.Json.JsonSerializationException:
Unexpected XmlNodeType when getting node name: EntityReference

I can't find any information about (non)supporting entities, so maybe I am doing something wrong?

dbc · Accepted Answer · 2017-12-19 17:14:47Z

1

The exception is explanatory: Json.NET apparently hasn't implemented conversion of XmlEntityReference nodes to JSON. This is the XmlNode subtype that is used to represent the &ent; entity reference.

To avoid the limitation you will need to expand entities while reading your XML, for instance like so:

var settings = new XmlReaderSettings
{
    // Allow processing of DTD
    DtdProcessing = DtdProcessing.Parse,
    // On older versions of .Net instead set 
    //ProhibitDtd = false,
    // But for security, prevent DOS attacks by limiting the total number of characters that can be expanded to something sane.
    MaxCharactersFromEntities = (long)1e7,
    // And for security, disable resolution of entities from external documents.
    XmlResolver = null,
};
XmlDocument doc = new XmlDocument();
using (var textReader = new StringReader(xml))
using (var xmlReader = XmlReader.Create(textReader, settings))
{
    doc.Load(xmlReader);
}
string json = JsonConvert.SerializeXmlNode(doc, Newtonsoft.Json.Formatting.Indented);
Console.WriteLine(json);

Notes:

It's possible for an untrusted XML file to perform a Denial-of-Service attack by forcing an out-of-memory exception via cleverly crafted DTD entities and entity references, as shown here. Setting XmlReaderSettings.MaxCharactersFromEntities to something reasonable should mitigate that.

This specific value was taken from the reference source for XDocument.Load(). Modify to fit your needs.
Similarly setting XmlReaderSettings.XmlResolver = null prevents untrusted XML from generating unexpected requests to external resources.

Or you could switch to the XDocument API in which entities are always expanded and security settings are more appropriate by default:

var doc = XDocument.Parse(xml);
string json = JsonConvert.SerializeXNode(doc, Newtonsoft.Json.Formatting.Indented);
Console.WriteLine(json);

Working .Net fiddle showing that the &ent; node gets expanded to its value Sample text:

{
  "?xml": {
    "@version": "1.0",
    "@standalone": "no"
  },
  "!DOCTYPE": {
    "@name": "notes",
    "@internalSubset": "\n        <!ENTITY ent 'Sample text'>\n    "
  },
  "notes": {
    "note": "Sample text"
  }
}

edited Dec 19, 2017 at 17:14

answered Dec 19, 2017 at 7:03

dbc

120k27 gold badges273 silver badges404 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

andrzej1_1 Over a year ago

Whoa, thank you for great fiddle! This solve my problem, but I am also wondering, whether it is possible to deserialize these JSONs to initial XML with entities?

dbc Over a year ago

You mean, with entities, or with entity references? entity references are definitely not supported, logic for them simply doesn't appear in XmlNodeConverter.cs. If entities, I'm not sure. Can you ask another question with a minimal reproducible example?

dbc Over a year ago

@andrzej1_1 - XmlTextReader is deprecated so updated answer to use XmlReader.Create(textReader, settings)

andrzej1_1 Over a year ago

I mean entity references, so there is no need to ask another question if you said they are not supported. And thanks for update.

dbc Over a year ago

@andrzej1_1 - you could request an enhancement to XmlNodeConverter.cs to support them at github.com/JamesNK/Newtonsoft.Json/issues.

|

Collectives™ on Stack Overflow

XML entities in Json.NET

1 Answer 1

6 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related