Does LINQ to XML ignore includes from a DTD?

问题

I'm using the MathML DTD for parsing MathML using System.Xml.Linq. While the ordinary MathML stuff gets recognized fine, the MMLEXTRA include in the DTD gets ignored and I get errors. Here's the code I'm using:

  if (!string.IsNullOrWhiteSpace(mathML))
  {
    try
    {
      const string preamble =
          "<!DOCTYPE mml:math PUBLIC \"-//W3C//DTD MathML 2.0//EN\"\n" +
           "\"http://www.w3.org/Math/DTD/mathml2/mathml2.dtd\" [\n" +
           "<!ENTITY % MATHML.prefixed \"INCLUDE\">\n" +
           "<!ENTITY % MATHML.prefix \"mml\"> \n" +
         "]>";
      var parsed = Parser.Parse(preamble + Environment.NewLine + mathML);
      textEditor.Text = printed;
      lblStatus.Caption = "MathML successfully translated.";
    } 
    catch (Exception e)
    {
      lblStatus.Caption = "Cannot translate text. " + e.Message;
    }
  }

The parser simply does XDocument.Load(). Any help appreciated!

回答1:

From here

Entities in DTDs are inherently not secure. It is possible for a malicious XML document that contains a DTD to cause the parser to use all memory and CPU time, causing a denial of service attack. Therefore, in LINQ to XML, DTD processing is turned off by default. You should not accept DTDs from untrusted sources.

However, to enable it you should use XDocumentType class.

A couple of possible solutions:

XmlReaderSettings settings = new XmlReaderSettings();
settings.ProhibitDtd = false;

XmlReader reader = XmlReader.Create(Server.MapPath("filename"), settings);

XDocument doc = XDocument.Load(reader);

Or maybe:

 XDocument xDocument = new XDocument(new XDocumentType("Books",null,"Books.dtd", null),new XElement("Book"));

All information is from that same source

来源：https://stackoverflow.com/questions/5391274/does-linq-to-xml-ignore-includes-from-a-dtd

标签

xml

linq-to-xml

dtd

mathml