CA3076: Insecure XSLT Script Execution
Note
This article applies to Visual Studio 2015. If you're looking for the latest Visual Studio documentation, see Visual Studio documentation. We recommend upgrading to the latest version of Visual Studio. Download it here
Item | Value |
---|---|
TypeName | InsecureXSLTScriptExecution |
CheckId | CA3076 |
Category | Microsoft.Security |
Breaking Change | Non Breaking |
Cause
If you execute Extensible Stylesheets Language Transformations (XSLT) in .NET applications insecurely, the processor may resolve untrusted URI references that could disclose sensitive information to attackers, leading to Denial of Service and Cross-Site attacks.
Rule Description
XSLT is a World Wide Web Consortium (W3C) standard for transforming XML data. XSLT is typically used to write style sheets to transform XML data to other formats such as HTML, fixed length text, comma-separated text, or a different XML format. Although prohibited by default, you may choose to enable it for your project.
To ensure you're not exposing an attack surface, this rule triggers whenever the XslCompiledTransform.Load receives insecure combination instances of XsltSettings and XmlResolver, which allows malicious script processing.
How to Fix Violations
Replace the insecure XsltSettings argument with XsltSettings.Default or with an instance that has disabled document function and script execution.
Replace the XmlResolver argument with null or an XmlSecureResolver instance.
When to Suppress Warnings
Unless you're sure that the input is known to be from a trusted source, do not suppress a rule from this warning.
Pseudo-code Examples
Violation
using System.Xml;
using System.Xml.Xsl;
namespace TestNamespace
{
class TestClass
{
void TestMethod()
{
XslCompiledTransform xslCompiledTransform = new XslCompiledTransform();
var settings = XsltSettings.TrustedXslt;
var resolver = new XmlUrlResolver();
xslCompiledTransform.Load("testStylesheet", settings, resolver); // warn
}
}
}
Solution
using System.Xml;
using System.Xml.Xsl;
namespace TestNamespace
{
class TestClass
{
void TestMethod()
{
XslCompiledTransform xslCompiledTransform = new XslCompiledTransform();
var settings = XsltSettings.Default;
var resolver = new XmlUrlResolver();
xslCompiledTransform.Load("testStylesheet", settings, resolver);
}
}
}
Violation
using System.Xml;
using System.Xml.Xsl;
namespace TestNamespace
{
class TestClass
{
private static void TestMethod(XsltSettings settings)
{
try
{
XslCompiledTransform xslCompiledTransform = new XslCompiledTransform();
var resolver = new XmlUrlResolver();
xslCompiledTransform.Load("testStylesheet", settings, resolver); // warn
}
catch { throw; }
finally { }
}
}
}
Solution
using System.Xml;
using System.Xml.Xsl;
namespace TestNamespace
{
class TestClass
{
private static void TestMethod(XsltSettings settings)
{
try
{
XslCompiledTransform xslCompiledTransform = new XslCompiledTransform();
settings.EnableDocumentFunction = false;
settings.EnableScript = false;
var resolver = new XmlUrlResolver();
xslCompiledTransform.Load("testStylesheet", settings, resolver);
}
catch { throw; }
finally { }
}
}
}