Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 3242db5

Browse filesBrowse files
dpsennerfluffynuts
dpsenner
authored and
fluffynuts
committed
XmlConfigurator: do longer allow dtd processing across all platforms (LOG4NET-575)
This patch fixes a security vulnerabiliy reported by Karthik Balasundaram. The security vulnerability was found in the way how log4net parses xml configuration files where it allowed to process XML External Entity Processing. An attacker could use this as an attack vector if he could modify the XML configuration file.
1 parent c728a70 commit 3242db5
Copy full SHA for 3242db5

File tree

Expand file treeCollapse file tree

1 file changed

+3
-3
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

1 file changed

+3
-3
lines changed
Open diff view settings
Collapse file

‎src/log4net/Config/XmlConfigurator.cs‎

Copy file name to clipboardExpand all lines: src/log4net/Config/XmlConfigurator.cs
+3-3Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -721,10 +721,10 @@ static private void InternalConfigure(ILoggerRepository repository, Stream confi
721721
// is obsolete: 'Use XmlReaderSettings.DtdProcessing property instead.'
722722
#if NETSTANDARD1_3 // TODO DtdProcessing.Parse not yet available (https://github.com/dotnet/corefx/issues/4376)
723723
settings.DtdProcessing = DtdProcessing.Ignore;
724-
#elif !NET_4_0 && !MONO_4_0 && !NETSTANDARD2_0
725-
settings.ProhibitDtd = false;
724+
#elif !NET_4_0 && !MONO_4_0
725+
settings.ProhibitDtd = true;
726726
#else
727-
settings.DtdProcessing = DtdProcessing.Parse;
727+
settings.DtdProcessing = DtdProcessing.Ignore;
728728
#endif
729729

730730
// Create a reader over the input stream

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.