Question

This has been bugging me for a couple days. I’m trying to load a XML from an uploaded file to into an XmlDocument object and get the following yellow-screen-of-death:

For security reasons DTD is prohibited in this XML document. To enable DTD processing set the ProhibitDtd property on XmlReaderSettings to false and pass the settings into XmlReader.Create method.

Here’s my code. You can clearly see I’m setting ProhibitDtd to false.

public static XmlDocument LoadXml(FileUpload fu)
{
    var settings = new XmlReaderSettings
                       {
                           ProhibitDtd = false, 
                           ValidationType = ValidationType.DTD
                       };
    var sDtdPath = string.Format(@"{0}", HttpContext.Current.Server.MapPath("/includes/dtds/2.3/archivearticle.dtd"));
    settings.Schemas.Add(null, sDtdPath);

    var r = XmlReader.Create(new StreamReader(fu.PostedFile.InputStream), settings);
    var document = new XmlDocument();
    document.Load(r);
    return document;
}

Answer 1

Add XmlResolver=null to your XmlReaderSettings. This will prevent the xmlDocument from trying to access the DTD. If you need to validate, do that in a separate operation.