Skip to content

XML Injection via XSLT Settings

Description

By setting `XsltSettings.EnableScript` or `XsltSettings.EnableDocumentFunction` to true, an adversary who is able to influence the loaded XSL document could directly inject code to compromise the system. It is strongly recommended that an alternative approach is used to work with XML data.

Examples

Insecure Code

c#
XsltSettings xslt_settings = new XsltSettings(); xslt_settings.EnableScript = true;

Secure Code

c#
XsltSettings xslt_settings = new XsltSettings(); xslt_settings.EnableScript = false; xslt_settings.EnableDocumentFunction = false;

Remediation

Set `XsltSettings.EnableScript` and `XsltSettings.EnableDocumentFunction` to false, and modify the XML document prior to running the `XslCompiledTransform.Transform` method instead of using XSL scripts to execute functions.

Rule Details

FieldValue
IDCODE-0455
CategoryInjection
SeverityHIGH
CWECWE-91
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityMODERATE
TagsXSLT, XML Injection, Blind XPath injection
OWASPA1:2017-Injection, A03:2021-Injection