Description

Detects usage of the legacy XslTransform class in C# code which is vulnerable to XML External Entity (XXE) attacks. When processing XSLT transformations, XslTransform does not have proper entity handling controls, allowing attackers to potentially read sensitive files or conduct server-side request forgery through malicious XSLT content.

Detection Strategy

• Check for instantiation or usage of the 'XslTransform' class in C# source code

• Report vulnerability when 'XslTransform' class is found since it lacks proper XXE protections by default

• Recommend using XslCompiledTransform instead which has better security controls

Vulnerable code example

using System.Xml.Xsl;
using System.Xml.XPath;

class XsltExample {
    void ProcessXml() {
        XslTransform transform = new XslTransform();
        // VULNERABLE: Loading XSLT from untrusted remote source enables code execution
        transform.Load("https://external-server.com/style.xsl");...

✅ Secure code example

using System.Xml;
using System.Xml.Xsl;
using System.Xml.XPath;

class XsltExample {
    void ProcessXml() {
        // Use XslCompiledTransform and disable dangerous features
        var transform = new XslCompiledTransform();...