XmlReaderSettings.MaxCharactersFromEntities Property
Definition
Important
Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Gets or sets a value indicating the maximum allowable number of characters in a document that result from expanding entities.
public:
property long MaxCharactersFromEntities { long get(); void set(long value); };
public long MaxCharactersFromEntities { get; set; }
member this.MaxCharactersFromEntities : int64 with get, set
Public Property MaxCharactersFromEntities As Long
Property Value
The maximum allowable number of characters from expanded entities. The default is 0.
Examples
The following code sets this property, and then attempts to parse a document that contains an entity that expands to a size greater than the set limit. In a real world scenario, you would set this limit to a value large enough to handle valid documents, yet small enough to limit the threat from malicious documents.
string markup =
@"<!DOCTYPE Root [
<!ENTITY anEntity ""Expands to more than 30 characters"">
<!ELEMENT Root (#PCDATA)>
]>
<Root>Content &anEntity;</Root>";
XmlReaderSettings settings = new XmlReaderSettings();
settings.DtdProcessing = DtdProcessing.Parse;
settings.ValidationType = ValidationType.DTD;
settings.MaxCharactersFromEntities = 30;
try
{
XmlReader reader = XmlReader.Create(new StringReader(markup), settings);
while (reader.Read()) { }
}
catch (XmlException ex)
{
Console.WriteLine(ex.Message);
}
Dim markup As String = _
"<!DOCTYPE Root [" + Environment.NewLine + _
" <!ENTITY anEntity ""Expands to more than 30 characters"">" + Environment.NewLine + _
" <!ELEMENT Root (#PCDATA)>" + Environment.NewLine + _
"]>" + Environment.NewLine + _
"<Root>Content &anEntity;</Root>"
Dim settings As XmlReaderSettings = New XmlReaderSettings()
settings.DtdProcessing = DtdProcessing.Parse;
settings.ValidationType = ValidationType.DTD
settings.MaxCharactersFromEntities = 30
Try
Dim reader As XmlReader = XmlReader.Create(New StringReader(markup), settings)
While (reader.Read())
End While
Catch ex As XmlException
Console.WriteLine(ex.Message)
End Try
This example produces the following output:
There is an error in XML document (MaxCharactersFromEntities, ).
Remarks
A zero (0) value means no limits on the number of characters that result from expanding entities. A non-zero value specifies the maximum number of characters that can result from expanding entities.
If the reader attempts to read a document that contains entities such that the expanded size will exceed this property, an XmlException will be thrown.
This property allows you to mitigate denial of service attacks where the attacker submits XML documents that attempt to exceed memory limits via expanding entities. By limiting the characters that result from expanded entities, you can detect the attack and recover reliably.