在C＃中针对DTD验证XML的问题

Question

这一直困扰着我几天。我正在尝试将上传文件中的XML加载到XmlDocument对象中并获得以下黄色死屏：

For security reasons DTD is prohibited in this XML document. To enable DTD processing set the ProhibitDtd property on XmlReaderSettings to false and pass the settings into XmlReader.Create method.

这是我的代码。您可以清楚地看到我将ProhibitDtd设置为false。

public static XmlDocument LoadXml(FileUpload fu)
{
    var settings = new XmlReaderSettings
                       {
                           ProhibitDtd = false, 
                           ValidationType = ValidationType.DTD
                       };
    var sDtdPath = string.Format(@"{0}", HttpContext.Current.Server.MapPath("/includes/dtds/2.3/archivearticle.dtd"));
    settings.Schemas.Add(null, sDtdPath);

    var r = XmlReader.Create(new StreamReader(fu.PostedFile.InputStream), settings);
    var document = new XmlDocument();
    document.Load(r);
    return document;
}

Answer 1

将XmlResolver=null添加到XmlReaderSettings。这将阻止xmlDocument尝试访问DTD。如果您需要验证，请在单独的操作中执行此操作。