dotnet/msbuild

XmlPoke Should Use DtdProcessing.Prohibit

Open

#5,817 opened on Oct 21, 2020

View on GitHub
 (7 comments) (0 reactions) (1 assignee)C# (5,062 stars) (1,364 forks)batch import
Good First Issuebugtriaged

Description

See https://github.com/dotnet/msbuild/issues/5810 for a bit of context.

There's an inconsistency with XmlPoke and XslTransformation. The docs on XmlReaderSettings.DtdProcessing state that the default value is Prohibit, which neither XmlPoke or XslTransformation` follow.

Contributor guide

Tech stack
csharp
Domain
backendbuild systemsecurity
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
blocked
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
C#MSBuild internalsXML security
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Check the linked issue #5810 for context. Examine the XmlPoke task in the MSBuild codebase, specifically how it constructs XmlReaderSettings. Compare with XslTransformation to understand the inconsistency. The fix should set DtdProcessing to Prohibit, consistent with documentation. Since the issue is assigned, coordinate with the assignee before starting.