Skip to content

Bug/dtd fix #2583

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
swmal merged 6 commits into from
Oct 15, 2026
Merged

Bug/dtd fix #2583

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1cac415
Added prohibit dtd to external reference document read
JanKallman Sep 28, 2026
4ebe12a
Created new method for creating XmlReader's with DTD prohibited
JanKallman Sep 28, 2026
d45fef4
Merge branch 'develop8' into bug/dtd-fix
JanKallman Oct 15, 2026
73abec6
Several fixes for GHSA-f4h2-2r6m-w59r
JanKallman Oct 15, 2026
b7fd022
Updated System.Security.Cryptography.Xml and System.Security.Cryptogr…
JanKallman Oct 15, 2026
62d25da
Added more fixes in CrtxTemplateHelper and ImageReader
JanKallman Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions src/Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,10 @@
<PackageVersion Include="Microsoft.IO.RecyclableMemoryStream" Version="3.0.1" />
<PackageVersion Include="MSTest" Version="3.10.2" />
<PackageVersion Include="System.ComponentModel.Annotations" Version="5.0.0" />
<PackageVersion Include="System.Drawing.Common" Version="8.0.26" />
<PackageVersion Include="System.Drawing.Common" Version="8.0.32" />
<PackageVersion Include="System.Formats.Asn1" Version="8.0.2" />
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.1" />
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.4" />
<PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.2" />
<PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.5" />
<PackageVersion Include="System.Text.Encoding.CodePages" Version="8.0.0" />
<PackageVersion Include="System.Text.Json" Version="8.0.6" />
</ItemGroup>
Expand Down
2 changes: 1 addition & 1 deletion src/EPPlus/DigitalSignatures/ExcelDigitalSignature.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@ internal ExcelDigitalSignature(ExcelWorkbook wb, XmlNamespaceManager ns, ZipPack
PreserveWhitespace = true,
};
//Full read only REALLY relevant for verification of signature
_doc.Load(part.GetStream());
LoadXmlSafe(_doc, part.GetStream());
var isVerified = IsValid;

//Read signing method
Expand Down
6 changes: 3 additions & 3 deletions src/EPPlus/Drawing/Chart/Style/CrtxTemplateHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ internal static void LoadCrtx(Stream stream, out XmlDocument chartXml, out XmlDo
{
var chartPart = p.GetPart(chartRel.TargetUri);
chartXml = new XmlDocument();
chartXml.Load(chartPart.GetStream());
XmlHelper.LoadXmlSafe(chartXml, chartPart.GetStream());
var rels = chartPart.GetRelationships();
foreach (var rel in rels)
{
Expand All @@ -53,11 +53,11 @@ internal static void LoadCrtx(Stream stream, out XmlDocument chartXml, out XmlDo
break;
case ExcelPackage.schemaChartStyleRelationships:
styleXml = new XmlDocument();
styleXml.Load(part.GetStream());
XmlHelper.LoadXmlSafe(styleXml, chartPart.GetStream());
break;
case ExcelPackage.schemaChartColorStyleRelationships:
colorsXml = new XmlDocument();
colorsXml.Load(part.GetStream());
XmlHelper.LoadXmlSafe(colorsXml, chartPart.GetStream());
break;
}
}
Expand Down
2 changes: 1 addition & 1 deletion src/EPPlus/Drawing/Chart/Style/ExcelChartStyleManager.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -996,7 +996,7 @@ private ZipPackageRelationship CreateThemeOverridePart(ZipPackage p, ZipPackageP
ThemeOverridePart = p.CreatePart(ThemeOverrideUri, ContentTypes.contentTypeThemeOverride);

ThemeOverrideXml = new XmlDocument();
ThemeOverrideXml.Load(partToCopy.GetStream());
LoadXmlSafe(ThemeOverrideXml, partToCopy.GetStream());

foreach (var themeRel in partToCopy.GetRelationships())
{
Expand Down
4 changes: 2 additions & 2 deletions src/EPPlus/Drawing/ImageHandling/ImageReader.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -769,7 +769,7 @@ private static bool IsSvg(MemoryStream ms, ref double width, ref double height)
{
try
{
var reader = new XmlTextReader(ms);
var reader = XmlHelper.CreateXmlReaderSafe(ms);
while (reader.Read())
{
if (reader.LocalName == "svg" && reader.NodeType == XmlNodeType.Element)
Expand Down Expand Up @@ -816,7 +816,7 @@ private static bool IsSvg(MemoryStream ms)
try
{
ms.Position = 0;
var reader = new XmlTextReader(ms);
var reader = XmlHelper.CreateXmlReaderSafe(ms);
while (reader.Read())
{
if (reader.LocalName == "svg" && reader.NodeType == XmlNodeType.Element)
Expand Down
5 changes: 3 additions & 2 deletions src/EPPlus/Drawing/Theme/ExcelThemeManager.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ Date Author Change
using System;
using System.IO;
using System.Linq;
using System.Text;
using System.Xml;

namespace OfficeOpenXml.Drawing.Theme
Expand Down Expand Up @@ -79,8 +80,8 @@ public void CreateDefaultTheme()
_defaultTheme = StyleResourceManager.GetItem("defaulttheme2022.Xml");
}
}
var themeXml = new XmlDocument();
themeXml.LoadXml(_defaultTheme);
var themeXml = new XmlDocument();
XmlHelper.LoadXmlSafe(themeXml, _defaultTheme, Encoding.UTF8);
Load(themeXml);
}
internal ExcelTheme GetOrCreateTheme()
Expand Down
16 changes: 8 additions & 8 deletions src/EPPlus/EPPlus.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -803,20 +803,20 @@
</ItemGroup>

<ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="9.0.18" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="9.0.21" />
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="9.0.18" />
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="9.0.21" />
<PackageReference Include="System.ComponentModel.Annotations" />
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="9.0.18" />
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="9.0.18" />
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="9.0.21" />
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="9.0.21" />
</ItemGroup>
<ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="10.0.10" />
<PackageReference Include="Microsoft.Extensions.Configuration.Json" VersionOverride="10.0.13" />
<PackageReference Include="Microsoft.IO.RecyclableMemoryStream" />
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="10.0.10" />
<PackageReference Include="System.Security.Cryptography.Pkcs" VersionOverride="10.0.13" />
<PackageReference Include="System.ComponentModel.Annotations" />
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="10.0.10" />
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="10.0.10" />
<PackageReference Include="System.Text.Encoding.CodePages" VersionOverride="10.0.13" />
<PackageReference Include="System.Security.Cryptography.Xml" VersionOverride="10.0.13" />
</ItemGroup>
<ItemGroup>
<Compile Remove="LoadFunctions\HeaderReader.cs" />
Expand Down
11 changes: 1 addition & 10 deletions src/EPPlus/ExcelWorkbook.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,16 +365,7 @@ private void GetSharedStrings()
if (_package.ZipPackage.PartExists(SharedStringsUri))
{
Packaging.ZipPackagePart part = _package.ZipPackage.GetPart(SharedStringsUri);
#if Core
var xr = XmlReader.Create(part.GetStream(), new XmlReaderSettings()
{
DtdProcessing = DtdProcessing.Prohibit,
IgnoreWhitespace = true,
});

#else
var xr = new XmlTextReader(part.GetStream());
#endif
var xr = XmlHelper.CreateXmlReaderSafe(part.GetStream(), WhitespaceHandling.Significant);
int index = 0;
while (xr.Read())
{
Expand Down
2 changes: 1 addition & 1 deletion src/EPPlus/ExternalReferences/ExcelExternalLinksCollection.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ internal void LoadExternalReferences()
string rID = elem.GetAttribute("id",ExcelPackage.schemaRelationships);
var rel = _wb.Part.GetRelationship(rID);
var part = _wb._package.ZipPackage.GetPart(UriHelper.ResolvePartUri(rel.SourceUri, rel.TargetUri));
var xr = new XmlTextReader(part.GetStream());
var xr = XmlHelper.CreateXmlReaderSafe(part.GetStream());
while (xr.Read())
{
if (xr.NodeType == XmlNodeType.Element)
Expand Down
12 changes: 12 additions & 0 deletions src/EPPlus/XmlHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1435,6 +1435,18 @@ internal static void LoadXmlSafe(XmlDocument xmlDoc, Stream stream)
XmlReader reader = XmlReader.Create(sr, settings);
xmlDoc.Load(reader);
}
internal static XmlTextReader CreateXmlReaderSafe(Stream stream, WhitespaceHandling whitespaceHandling=WhitespaceHandling.All)
{
var xr = new XmlTextReader(stream);
xr.WhitespaceHandling = whitespaceHandling;
#if (NET35)
xr.ProhibitDtd = true;
#else
xr.DtdProcessing = DtdProcessing.Prohibit;
#endif
return xr;
}

internal static void LoadXmlSafe(XmlDocument xmlDoc, string xml, Encoding encoding)
{
using (var stream = EPPlusMemoryManager.GetStream(encoding.GetBytes(xml)))
Expand Down
Loading