如何解决JsonConvert.DeserializeXmlNode的Fortify JSON注入问题

Got it, let's break down why this alert is popping up and how to resolve it. Fortify flags this line because JsonConvert.DeserializeXmlNode takes untrusted JSON input and directly converts it to XML without validation—malicious actors could craft JSON that creates dangerous XML structures (like XXE attacks, invalid entities, or tampered node hierarchies).

Here are actionable fixes, ordered by best practice:

1. Use Strongly-Typed Object Serialization (Recommended) #

Instead of converting JSON straight to XML, first deserialize the JSON into a strongly-typed .NET object. This enforces that the input matches your expected structure, blocking any unexpected or malicious fields. Then serialize that object to XML safely.

Example code:

// Define a class that matches your expected JSON/XML structure
public class Grading
{
    public string StudentId { get; set; }
    public int Score { get; set; }
    public string Feedback { get; set; }
    // Add all expected properties here
}

// Step 1: Deserialize JSON to strongly-typed object
var gradingData = JsonConvert.DeserializeObject<Grading>(inputObj.ToString());

// Step 2: Serialize the object to XML
var serializer = new XmlSerializer(typeof(Grading));
XmlDocument dataDoc = new XmlDocument();

using (var stringWriter = new StringWriter())
{
    serializer.Serialize(stringWriter, gradingData);
    dataDoc.LoadXml(stringWriter.ToString());
}

This approach ensures only valid, expected data makes it into the XML, eliminating the injection risk entirely.

2. Validate and Sanitize Input #

If you can't use a strongly-typed object, validate the JSON input before conversion:

• Use JSON Schema to validate that the input matches your expected structure (e.g., required fields, data types, allowed values).
• Sanitize any XML-special characters (like <, >, &, ', ") in JSON values to prevent them from breaking or manipulating the XML structure. Just be careful not to corrupt valid JSON in the process.

3. Secure XML Loading #

If you must keep direct JSON-to-XML conversion, harden the XML loading step to block dangerous content:

// Convert JSON to XML string first
string xmlContent = JsonConvert.DeserializeXmlNode(inputObj.ToString(), "grading").OuterXml;

// Configure XmlReader with strict security settings
var xmlSettings = new XmlReaderSettings
{
    DtdProcessing = DtdProcessing.Prohibit, // Block DTDs to prevent XXE
    XmlResolver = null, // Disable external entity resolution
    MaxCharactersFromEntities = 0 // Limit entity expansion
};

// Load XML using the secure settings
XmlDocument dataDoc = new XmlDocument();
using (var xmlReader = XmlReader.Create(new StringReader(xmlContent), xmlSettings))
{
    dataDoc.Load(xmlReader);
}

This reduces the risk of XML-based attacks even if the JSON-to-XML conversion introduces problematic content.

4. Mark as False Positive (Only If Input Is 100% Trusted) #

If inputObj comes from a fully trusted source (e.g., internal systems with no user-controlled input), you can mark this alert as a false positive in Fortify. Be sure to add a clear comment explaining why the input is safe—only do this if you're absolutely certain there's no exposure.

内容的提问来源于stack exchange，提问作者manish