Click here to Skip to main content
15,903,012 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Fortify Scan reported Missing XML validation at below line.
XmlReader.Create(memoryStream)


There is no XSD available for input string. I want to validate memoryStream before it is going to XmlReader.Create(memoryStream). Is there any best way to validate memoryStream for XML in below code to satisfy Fortify Scan.

Actual code:

C#
RequestSecurityTokenResponse resp;
            using (MemoryStream memoryStream = new MemoryStream(Convert.FromBase64String(tokenstring)))
            using (XmlReader xmlReader = XmlReader.Create(memoryStream))
            {
                WSTrust13ResponseSerializer serializer = new WSTrust13ResponseSerializer();
                WSTrustSerializationContext serializationContext = new WSTrustSerializationContext();
                resp = serializer.ReadXml(xmlReader, serializationContext);
            }


Fortify Says:
Failure to enable validation when parsing XML gives an attacker the opportunity to supply malicious input.

Most successful attacks begin with a violation of the programmer's assumptions. By accepting an XML document without validating it against a DTD or XML schema, the programmer leaves a door open for attackers to provide unexpected, unreasonable, or malicious input. It is not possible for an XML parser to validate all aspects of a document's content; a parser cannot understand the complete semantics of the data. However, a parser can do a complete and thorough job of checking the document's structure and therefore guarantee to the code that processes the document that the content is well-formed.

What I have tried:

Tried to throw error when TryParsToXML(string) is not parsing.
Posted
Updated 2-Feb-17 21:22pm

I don't get it... Fortify exactly told you what's the problem. But you don't want to follow it? So ignore it, and live with the "security risk" or follow the recommendation - create a proper xsd for your data to verify against.

Btw. did I mention that I think fortify is total crap? ;)

What I would do: ignore it until I have no other problems, and it's nothing good on TV to watch...
 
Share this answer
 
add XmlReaderSettings to XmlReader.Create method.
please ref Missing XML Validation | 亂馬客 - 點部落[^]
 
Share this answer
 
v2

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900