diff --git a/eng/Versions.props b/eng/Versions.props
index d739bd35d783e5..5f1fcbcd517fb8 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -233,7 +233,7 @@
8.0.0-rtm.25625.2
- 2.4.16
+ 2.4.17
16.0.5-alpha.1.25311.1
16.0.5-alpha.1.25311.1
diff --git a/eng/pipelines/common/xplat-setup.yml b/eng/pipelines/common/xplat-setup.yml
index 5292eb6fc2bada..58a8ee2e7a1461 100644
--- a/eng/pipelines/common/xplat-setup.yml
+++ b/eng/pipelines/common/xplat-setup.yml
@@ -171,7 +171,7 @@ jobs:
# Official Build Linux Pool
${{ if and(or(in(parameters.osGroup, 'linux', 'freebsd', 'android', 'tizen'), eq(parameters.jobParameters.hostedOs, 'linux')), ne(variables['System.TeamProject'], 'public')) }}:
name: $(DncEngInternalBuildPool)
- demands: ImageOverride -equals 1es-ubuntu-2204
+ demands: ImageOverride -equals build.azurelinux.3.amd64
os: linux
# OSX Public Build Pool (we don't have on-prem OSX BuildPool).
diff --git a/src/libraries/System.ComponentModel.Annotations/src/System/ComponentModel/DataAnnotations/EmailAddressAttribute.cs b/src/libraries/System.ComponentModel.Annotations/src/System/ComponentModel/DataAnnotations/EmailAddressAttribute.cs
index de5a86a64ac8c0..a8f9ea5abcec73 100644
--- a/src/libraries/System.ComponentModel.Annotations/src/System/ComponentModel/DataAnnotations/EmailAddressAttribute.cs
+++ b/src/libraries/System.ComponentModel.Annotations/src/System/ComponentModel/DataAnnotations/EmailAddressAttribute.cs
@@ -7,9 +7,6 @@ namespace System.ComponentModel.DataAnnotations
AllowMultiple = false)]
public sealed class EmailAddressAttribute : DataTypeAttribute
{
- private static bool EnableFullDomainLiterals { get; } =
- AppContext.TryGetSwitch("System.Net.AllowFullDomainLiterals", out bool enable) ? enable : false;
-
public EmailAddressAttribute()
: base(DataType.EmailAddress)
{
@@ -30,7 +27,7 @@ public override bool IsValid(object? value)
return false;
}
- if (!EnableFullDomainLiterals && (valueAsString.Contains('\r') || valueAsString.Contains('\n')))
+ if (valueAsString.Contains('\r') || valueAsString.Contains('\n'))
{
return false;
}
diff --git a/src/libraries/System.Net.Mail/src/System/Net/Mail/MailAddress.cs b/src/libraries/System.Net.Mail/src/System/Net/Mail/MailAddress.cs
index 644f7502ff7763..2942e6fba0d90e 100644
--- a/src/libraries/System.Net.Mail/src/System/Net/Mail/MailAddress.cs
+++ b/src/libraries/System.Net.Mail/src/System/Net/Mail/MailAddress.cs
@@ -15,9 +15,6 @@ namespace System.Net.Mail
//
public partial class MailAddress
{
- private static bool EnableFullDomainLiterals { get; } =
- AppContext.TryGetSwitch("System.Net.AllowFullDomainLiterals", out bool enable) ? enable : false;
-
// These components form an e-mail address when assembled as follows:
// "EncodedDisplayname"
private readonly Encoding _displayNameEncoding;
@@ -220,7 +217,7 @@ private string GetHost(bool allowUnicode)
}
}
- if (!EnableFullDomainLiterals && domain.AsSpan().IndexOfAny('\r', '\n') >= 0)
+ if (domain.AsSpan().IndexOfAny('\r', '\n') >= 0)
{
throw new SmtpException(SR.Format(SR.SmtpInvalidHostName, Address));
}
diff --git a/src/libraries/System.Net.Mail/src/System/Net/Mail/MailAddressParser.cs b/src/libraries/System.Net.Mail/src/System/Net/Mail/MailAddressParser.cs
index fe57dd93c14591..252a9520c26957 100644
--- a/src/libraries/System.Net.Mail/src/System/Net/Mail/MailAddressParser.cs
+++ b/src/libraries/System.Net.Mail/src/System/Net/Mail/MailAddressParser.cs
@@ -68,6 +68,20 @@ private static bool TryParseAddress(string data, bool expectMultipleAddresses, r
Debug.Assert(!string.IsNullOrEmpty(data));
Debug.Assert(index >= 0 && index < data.Length, $"Index out of range: {index}, {data.Length}");
+ // Check for CR or LF characters which are not allowed in mail addresses.
+ // Only scan on the first call (index == data.Length - 1) to avoid repeated O(n) scans
+ // when parsing multiple addresses from the same string.
+ if (index == data.Length - 1 && MailBnfHelper.HasCROrLF(data))
+ {
+ if (throwExceptionIfFail)
+ {
+ throw new FormatException(SR.MailAddressInvalidFormat);
+ }
+
+ parseAddressInfo = default;
+ return false;
+ }
+
// Parsed components to be assembled as a MailAddress later
string? displayName;
diff --git a/src/libraries/System.Net.Mail/tests/Functional/SmtpClientTest.cs b/src/libraries/System.Net.Mail/tests/Functional/SmtpClientTest.cs
index a9cf0bca251ce8..c2cf89efb6d76b 100644
--- a/src/libraries/System.Net.Mail/tests/Functional/SmtpClientTest.cs
+++ b/src/libraries/System.Net.Mail/tests/Functional/SmtpClientTest.cs
@@ -14,10 +14,8 @@
using System.IO;
using System.Net.NetworkInformation;
using System.Net.Sockets;
-using System.Reflection;
using System.Threading;
using System.Threading.Tasks;
-using Microsoft.DotNet.RemoteExecutor;
using Systen.Net.Mail.Tests;
using System.Net.Test.Common;
using Xunit;
@@ -578,58 +576,19 @@ public void TestGssapiAuthentication()
Assert.Equal("GSSAPI", server.AuthMethodUsed, StringComparer.OrdinalIgnoreCase);
}
- [ConditionalTheory(typeof(RemoteExecutor), nameof(RemoteExecutor.IsSupported))]
- [InlineData("foo@[\r\n bar]")]
- [InlineData("foo@[bar\r\n ]")]
- [InlineData("foo@[bar\r\n baz]")]
- public void MultiLineDomainLiterals_Enabled_Success(string input)
- {
- RemoteExecutor.Invoke(static (string @input) =>
- {
- AppContext.SetSwitch("System.Net.AllowFullDomainLiterals", true);
-
- var address = new MailAddress(@input);
-
- // Using address with new line breaks the protocol so we cannot easily use LoopbackSmtpServer
- // Instead we call internal method that does the extra validation.
- string? host = (string?)typeof(MailAddress).InvokeMember("GetAddress", BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.InvokeMethod, null, address, new object[] { true });
- Assert.Equal(input, host);
- }, input).Dispose();
- }
-
[Theory]
[MemberData(nameof(SendMail_MultiLineDomainLiterals_Data))]
- public async Task SendMail_MultiLineDomainLiterals_Disabled_Throws(string from, string to, bool asyncSend)
+ public void SendMail_MultiLineDomainLiterals_Disabled_Throws(string from, string to)
{
- using var server = new LoopbackSmtpServer();
-
- using SmtpClient client = server.CreateClient();
- client.Credentials = new NetworkCredential("Foo", "Bar");
-
- using var msg = new MailMessage(@from, @to, "subject", "body");
-
- await Assert.ThrowsAsync(async () =>
- {
- if (asyncSend)
- {
- await client.SendMailAsync(msg).WaitAsync(TimeSpan.FromSeconds(30));
- }
- else
- {
- client.Send(msg);
- }
- });
+ Assert.Throws(() => new MailMessage(@from, @to, "subject", "body"));
}
public static IEnumerable SendMail_MultiLineDomainLiterals_Data()
{
- foreach (bool async in new[] { true, false })
+ foreach (string address in new[] { "foo@[\r\n bar]", "foo@[bar\r\n ]", "foo@[bar\r\n baz]" })
{
- foreach (string address in new[] { "foo@[\r\n bar]", "foo@[bar\r\n ]", "foo@[bar\r\n baz]" })
- {
- yield return new object[] { address, "foo@example.com", async };
- yield return new object[] { "foo@example.com", address, async };
- }
+ yield return new object[] { address, "foo@example.com" };
+ yield return new object[] { "foo@example.com", address };
}
}
}
diff --git a/src/libraries/System.Net.Mail/tests/Unit/MailAddressTests/MailAddressParserTest.cs b/src/libraries/System.Net.Mail/tests/Unit/MailAddressTests/MailAddressParserTest.cs
index 967fbae41cf1c0..6985a77e4e7747 100644
--- a/src/libraries/System.Net.Mail/tests/Unit/MailAddressTests/MailAddressParserTest.cs
+++ b/src/libraries/System.Net.Mail/tests/Unit/MailAddressTests/MailAddressParserTest.cs
@@ -559,5 +559,39 @@ public void ParseAddresses_WithManyComplexAddresses_ShouldReadCorrectly()
Assert.Equal("\" asciin;,oqu o.tesws \"", result[6].User);
Assert.Equal("this.test.this", result[6].Host);
}
+
+ [Theory]
+ [InlineData("test\r@example.com")]
+ [InlineData("test\n@example.com")]
+ [InlineData("test\r\n@example.com")]
+ [InlineData("Display\r\nName ")]
+ [InlineData("test@example\r.com")]
+ [InlineData("test@example\n.com")]
+ [InlineData("test@example.com\r\n")]
+ public void TryParseAddress_WithCROrLF_ShouldThrow(string address)
+ {
+ Assert.Throws(() => MailAddressParser.TryParseAddress(address, out _, throwExceptionIfFail: true));
+ }
+
+ [Theory]
+ [InlineData("test\r@example.com")]
+ [InlineData("test\n@example.com")]
+ [InlineData("test\r\n@example.com")]
+ [InlineData("Display\r\nName ")]
+ [InlineData("test@example\r.com")]
+ [InlineData("test@example\n.com")]
+ [InlineData("test@example.com\r\n")]
+ public void TryParseAddress_WithCROrLF_ShouldReturnFalse(string address)
+ {
+ Assert.False(MailAddressParser.TryParseAddress(address, out _, throwExceptionIfFail: false));
+ }
+
+ [Fact]
+ public void ParseMultipleAddresses_WithCROrLF_ShouldThrow()
+ {
+ Assert.Throws(() => MailAddressParser.ParseMultipleAddresses("a@b.com, test\r\n@example.com"));
+ Assert.Throws(() => MailAddressParser.ParseMultipleAddresses("test\n@example.com, a@b.com"));
+ Assert.Throws(() => MailAddressParser.ParseMultipleAddresses("a@b.com, c@d.com, e\r@f.com"));
+ }
}
}
diff --git a/src/libraries/System.Net.Mail/tests/Unit/MailAddressTests/MailAddressParsingTest.cs b/src/libraries/System.Net.Mail/tests/Unit/MailAddressTests/MailAddressParsingTest.cs
index f1755e9c8de4ad..84624bdddcab68 100644
--- a/src/libraries/System.Net.Mail/tests/Unit/MailAddressTests/MailAddressParsingTest.cs
+++ b/src/libraries/System.Net.Mail/tests/Unit/MailAddressTests/MailAddressParsingTest.cs
@@ -36,8 +36,7 @@ public static IEnumerable GetValidEmailTestData()
yield return new object[] { "testuser@[mail.com]" };
yield return new object[] { "testuser@[ mail.com] " };
yield return new object[] { "testuser@[mail.com ]" };
- yield return new object[] { "testuser@[mail.com \r\n ]" };
- yield return new object[] { "testuser@[ \r\n mail.com]" };
+ yield return new object[] { "testuser@[mail.com ]" };
yield return new object[] { "testuser@[ mail.com]" };
yield return new object[] { "testuser " };
yield return new object[] { "Test\u3044\u3069 User " };
@@ -90,8 +89,8 @@ public static IEnumerable GetValidEmailTestData()
yield return new object[] { "\"disp \f lay\" <\"testsome\"@NCLMailTest.com>" };
yield return new object[] { "\"EscapedUnicode \\\u3044\\\u3069 display\" " };
yield return new object[] { "(Unicode \u3044 Comment) <\"testsome\"@NCLMailTest.com>" };
- yield return new object[] { "\"display \r\n name\" <\"folding\"@domain.com>" };
- yield return new object[] { "\"test\r\n test\"@mail.com" };
+ yield return new object[] { "\"display name\" <\"folding\"@domain.com>" };
+ yield return new object[] { "\"test test\"@mail.com" };
// Email Address Internationalization (EAI)
yield return new object[] { "UnicodeUserName \"Test\u3044\u3069\"@NCLMailTest.com" };
yield return new object[] { "<\"EscapedUnicode \\\u3044\\\u3069 User\"@NCLMailTest.com>" };
@@ -127,6 +126,10 @@ public static IEnumerable GetInvalidEmailTestData()
yield return new object[] { "Bob \"display\" " };
yield return new object[] { "testuser@[mail.com \r ]" };
yield return new object[] { "testuser@[mail.com \n ]" };
+ yield return new object[] { "testuser@[mail.com \r\n ]" };
+ yield return new object[] { "testuser@[ \r\n mail.com]" };
+ yield return new object[] { "\"display \r\n name\" <\"folding\"@domain.com>" };
+ yield return new object[] { "\"test\r\n test\"@mail.com" };
yield return new object[] { "testuser@[mail\u3069.com]" }; // No unicode allowed in square brackets
yield return new object[] { "invalid@unicode\uD800.com" }; // D800 is a high surrogate
yield return new object[] { "invalid@unicode\uD800.com" }; // D800 is a high surrogate
diff --git a/src/libraries/System.Security.Cryptography.Xml/src/Resources/Strings.resx b/src/libraries/System.Security.Cryptography.Xml/src/Resources/Strings.resx
index 924132bd04547e..e2a5dc830a5cab 100644
--- a/src/libraries/System.Security.Cryptography.Xml/src/Resources/Strings.resx
+++ b/src/libraries/System.Security.Cryptography.Xml/src/Resources/Strings.resx
@@ -183,6 +183,9 @@
Signing key is not loaded.
+
+ The XML element has exceeded the maximum nesting depth allowed for decryption.
+
Symmetric algorithm is not specified. If the application has been trimmed, ensure the required algorithm implementations are preserved.
@@ -399,4 +402,4 @@
Xslts are only supported when dynamic code is supported.
-
\ No newline at end of file
+
diff --git a/src/libraries/System.Security.Cryptography.Xml/src/System.Security.Cryptography.Xml.csproj b/src/libraries/System.Security.Cryptography.Xml/src/System.Security.Cryptography.Xml.csproj
index a95102ecff9c64..e146923e46f477 100644
--- a/src/libraries/System.Security.Cryptography.Xml/src/System.Security.Cryptography.Xml.csproj
+++ b/src/libraries/System.Security.Cryptography.Xml/src/System.Security.Cryptography.Xml.csproj
@@ -4,8 +4,8 @@
true
$(NoWarn);CA1850
true
- false
- 2
+ true
+ 3
Provides classes to support the creation and validation of XML digital signatures. The classes in this namespace implement the World Wide Web Consortium Recommendation, "XML-Signature Syntax and Processing", described at http://www.w3.org/TR/xmldsig-core/.
Commonly Used Types:
@@ -101,6 +101,7 @@ System.Security.Cryptography.Xml.XmlLicenseTransform
+
diff --git a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/CanonicalizationDispatcher.cs b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/CanonicalizationDispatcher.cs
index ae5ff3e1c0c6fc..5813a99c35ed80 100644
--- a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/CanonicalizationDispatcher.cs
+++ b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/CanonicalizationDispatcher.cs
@@ -10,15 +10,32 @@ namespace System.Security.Cryptography.Xml
// implement ICanonicalizableNode; so a manual dispatch is sometimes necessary.
internal static class CanonicalizationDispatcher
{
+ [ThreadStatic]
+ private static int t_depth;
+
public static void Write(XmlNode node, StringBuilder strBuilder, DocPosition docPos, AncestralNamespaceContextManager anc)
{
- if (node is ICanonicalizableNode)
+ int maxDepth = LocalAppContextSwitches.DangerousMaxRecursionDepth;
+ if (maxDepth > 0 && t_depth > maxDepth)
+ {
+ throw new CryptographicException(SR.Cryptography_Xml_MaxDepthExceeded);
+ }
+
+ t_depth++;
+ try
{
- ((ICanonicalizableNode)node).Write(strBuilder, docPos, anc);
+ if (node is ICanonicalizableNode canonicalizableNode)
+ {
+ canonicalizableNode.Write(strBuilder, docPos, anc);
+ }
+ else
+ {
+ WriteGenericNode(node, strBuilder, docPos, anc);
+ }
}
- else
+ finally
{
- WriteGenericNode(node, strBuilder, docPos, anc);
+ t_depth--;
}
}
@@ -38,13 +55,27 @@ public static void WriteGenericNode(XmlNode node, StringBuilder strBuilder, DocP
public static void WriteHash(XmlNode node, HashAlgorithm hash, DocPosition docPos, AncestralNamespaceContextManager anc)
{
- if (node is ICanonicalizableNode)
+ int maxDepth = LocalAppContextSwitches.DangerousMaxRecursionDepth;
+ if (maxDepth > 0 && t_depth > maxDepth)
+ {
+ throw new CryptographicException(SR.Cryptography_Xml_MaxDepthExceeded);
+ }
+
+ t_depth++;
+ try
{
- ((ICanonicalizableNode)node).WriteHash(hash, docPos, anc);
+ if (node is ICanonicalizableNode canonicalizableNode)
+ {
+ canonicalizableNode.WriteHash(hash, docPos, anc);
+ }
+ else
+ {
+ WriteHashGenericNode(node, hash, docPos, anc);
+ }
}
- else
+ finally
{
- WriteHashGenericNode(node, hash, docPos, anc);
+ t_depth--;
}
}
diff --git a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedData.cs b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedData.cs
index 3de83fe10ebc08..a1982910cc18fc 100644
--- a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedData.cs
+++ b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedData.cs
@@ -17,55 +17,63 @@ public override void LoadXml(XmlElement value)
throw new ArgumentNullException(nameof(value));
}
- XmlNamespaceManager nsm = new XmlNamespaceManager(value.OwnerDocument.NameTable);
- nsm.AddNamespace("enc", EncryptedXml.XmlEncNamespaceUrl);
- nsm.AddNamespace("ds", SignedXml.XmlDsigNamespaceUrl);
-
- Id = Utils.GetAttribute(value, "Id", EncryptedXml.XmlEncNamespaceUrl);
- Type = Utils.GetAttribute(value, "Type", EncryptedXml.XmlEncNamespaceUrl);
- MimeType = Utils.GetAttribute(value, "MimeType", EncryptedXml.XmlEncNamespaceUrl);
- Encoding = Utils.GetAttribute(value, "Encoding", EncryptedXml.XmlEncNamespaceUrl);
-
- XmlNode? encryptionMethodNode = value.SelectSingleNode("enc:EncryptionMethod", nsm);
-
- // EncryptionMethod
- EncryptionMethod = new EncryptionMethod();
- if (encryptionMethodNode != null)
- EncryptionMethod.LoadXml((encryptionMethodNode as XmlElement)!);
-
- // Key Info
- KeyInfo = new KeyInfo();
- XmlNode? keyInfoNode = value.SelectSingleNode("ds:KeyInfo", nsm);
- if (keyInfoNode != null)
- KeyInfo.LoadXml((keyInfoNode as XmlElement)!);
-
- // CipherData
- XmlNode? cipherDataNode = value.SelectSingleNode("enc:CipherData", nsm);
- if (cipherDataNode == null)
- throw new CryptographicException(SR.Cryptography_Xml_MissingCipherData);
-
- CipherData = new CipherData();
- CipherData.LoadXml((cipherDataNode as XmlElement)!);
-
- // EncryptionProperties
- XmlNode? encryptionPropertiesNode = value.SelectSingleNode("enc:EncryptionProperties", nsm);
- if (encryptionPropertiesNode != null)
+ IncrementLoadXmlCurrentThreadDepth();
+ try
{
- // Select the EncryptionProperty elements inside the EncryptionProperties element
- XmlNodeList? encryptionPropertyNodes = encryptionPropertiesNode.SelectNodes("enc:EncryptionProperty", nsm);
- if (encryptionPropertyNodes != null)
+ XmlNamespaceManager nsm = new XmlNamespaceManager(value.OwnerDocument.NameTable);
+ nsm.AddNamespace("enc", EncryptedXml.XmlEncNamespaceUrl);
+ nsm.AddNamespace("ds", SignedXml.XmlDsigNamespaceUrl);
+
+ Id = Utils.GetAttribute(value, "Id", EncryptedXml.XmlEncNamespaceUrl);
+ Type = Utils.GetAttribute(value, "Type", EncryptedXml.XmlEncNamespaceUrl);
+ MimeType = Utils.GetAttribute(value, "MimeType", EncryptedXml.XmlEncNamespaceUrl);
+ Encoding = Utils.GetAttribute(value, "Encoding", EncryptedXml.XmlEncNamespaceUrl);
+
+ XmlNode? encryptionMethodNode = value.SelectSingleNode("enc:EncryptionMethod", nsm);
+
+ // EncryptionMethod
+ EncryptionMethod = new EncryptionMethod();
+ if (encryptionMethodNode != null)
+ EncryptionMethod.LoadXml((encryptionMethodNode as XmlElement)!);
+
+ // Key Info
+ KeyInfo = new KeyInfo();
+ XmlNode? keyInfoNode = value.SelectSingleNode("ds:KeyInfo", nsm);
+ if (keyInfoNode != null)
+ KeyInfo.LoadXml((keyInfoNode as XmlElement)!);
+
+ // CipherData
+ XmlNode? cipherDataNode = value.SelectSingleNode("enc:CipherData", nsm);
+ if (cipherDataNode == null)
+ throw new CryptographicException(SR.Cryptography_Xml_MissingCipherData);
+
+ CipherData = new CipherData();
+ CipherData.LoadXml((cipherDataNode as XmlElement)!);
+
+ // EncryptionProperties
+ XmlNode? encryptionPropertiesNode = value.SelectSingleNode("enc:EncryptionProperties", nsm);
+ if (encryptionPropertiesNode != null)
{
- foreach (XmlNode node in encryptionPropertyNodes)
+ // Select the EncryptionProperty elements inside the EncryptionProperties element
+ XmlNodeList? encryptionPropertyNodes = encryptionPropertiesNode.SelectNodes("enc:EncryptionProperty", nsm);
+ if (encryptionPropertyNodes != null)
{
- EncryptionProperty ep = new EncryptionProperty();
- ep.LoadXml((node as XmlElement)!);
- EncryptionProperties.Add(ep);
+ foreach (XmlNode node in encryptionPropertyNodes)
+ {
+ EncryptionProperty ep = new EncryptionProperty();
+ ep.LoadXml((node as XmlElement)!);
+ EncryptionProperties.Add(ep);
+ }
}
}
- }
- // Save away the cached value
- _cachedXml = value;
+ // Save away the cached value
+ _cachedXml = value;
+ }
+ finally
+ {
+ DecrementLoadXmlCurrentThreadDepth();
+ }
}
public override XmlElement GetXml()
diff --git a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedKey.cs b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedKey.cs
index 3cd2a7bc0a35ee..1762844daf1726 100644
--- a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedKey.cs
+++ b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedKey.cs
@@ -56,91 +56,99 @@ public override void LoadXml(XmlElement value)
throw new ArgumentNullException(nameof(value));
}
- XmlNamespaceManager nsm = new XmlNamespaceManager(value.OwnerDocument.NameTable);
- nsm.AddNamespace("enc", EncryptedXml.XmlEncNamespaceUrl);
- nsm.AddNamespace("ds", SignedXml.XmlDsigNamespaceUrl);
-
- Id = Utils.GetAttribute(value, "Id", EncryptedXml.XmlEncNamespaceUrl);
- Type = Utils.GetAttribute(value, "Type", EncryptedXml.XmlEncNamespaceUrl);
- MimeType = Utils.GetAttribute(value, "MimeType", EncryptedXml.XmlEncNamespaceUrl);
- Encoding = Utils.GetAttribute(value, "Encoding", EncryptedXml.XmlEncNamespaceUrl);
- Recipient = Utils.GetAttribute(value, "Recipient", EncryptedXml.XmlEncNamespaceUrl);
-
- XmlNode? encryptionMethodNode = value.SelectSingleNode("enc:EncryptionMethod", nsm);
-
- // EncryptionMethod
- EncryptionMethod = new EncryptionMethod();
- if (encryptionMethodNode != null)
- EncryptionMethod.LoadXml((encryptionMethodNode as XmlElement)!);
-
- // Key Info
- KeyInfo = new KeyInfo();
- XmlNode? keyInfoNode = value.SelectSingleNode("ds:KeyInfo", nsm);
- if (keyInfoNode != null)
- KeyInfo.LoadXml((keyInfoNode as XmlElement)!);
-
- // CipherData
- XmlNode? cipherDataNode = value.SelectSingleNode("enc:CipherData", nsm);
- if (cipherDataNode == null)
- throw new CryptographicException(SR.Cryptography_Xml_MissingCipherData);
-
- CipherData = new CipherData();
- CipherData.LoadXml((cipherDataNode as XmlElement)!);
-
- // EncryptionProperties
- XmlNode? encryptionPropertiesNode = value.SelectSingleNode("enc:EncryptionProperties", nsm);
- if (encryptionPropertiesNode != null)
+ IncrementLoadXmlCurrentThreadDepth();
+ try
{
- // Select the EncryptionProperty elements inside the EncryptionProperties element
- XmlNodeList? encryptionPropertyNodes = encryptionPropertiesNode.SelectNodes("enc:EncryptionProperty", nsm);
- if (encryptionPropertyNodes != null)
+ XmlNamespaceManager nsm = new XmlNamespaceManager(value.OwnerDocument.NameTable);
+ nsm.AddNamespace("enc", EncryptedXml.XmlEncNamespaceUrl);
+ nsm.AddNamespace("ds", SignedXml.XmlDsigNamespaceUrl);
+
+ Id = Utils.GetAttribute(value, "Id", EncryptedXml.XmlEncNamespaceUrl);
+ Type = Utils.GetAttribute(value, "Type", EncryptedXml.XmlEncNamespaceUrl);
+ MimeType = Utils.GetAttribute(value, "MimeType", EncryptedXml.XmlEncNamespaceUrl);
+ Encoding = Utils.GetAttribute(value, "Encoding", EncryptedXml.XmlEncNamespaceUrl);
+ Recipient = Utils.GetAttribute(value, "Recipient", EncryptedXml.XmlEncNamespaceUrl);
+
+ XmlNode? encryptionMethodNode = value.SelectSingleNode("enc:EncryptionMethod", nsm);
+
+ // EncryptionMethod
+ EncryptionMethod = new EncryptionMethod();
+ if (encryptionMethodNode != null)
+ EncryptionMethod.LoadXml((encryptionMethodNode as XmlElement)!);
+
+ // Key Info
+ KeyInfo = new KeyInfo();
+ XmlNode? keyInfoNode = value.SelectSingleNode("ds:KeyInfo", nsm);
+ if (keyInfoNode != null)
+ KeyInfo.LoadXml((keyInfoNode as XmlElement)!);
+
+ // CipherData
+ XmlNode? cipherDataNode = value.SelectSingleNode("enc:CipherData", nsm);
+ if (cipherDataNode == null)
+ throw new CryptographicException(SR.Cryptography_Xml_MissingCipherData);
+
+ CipherData = new CipherData();
+ CipherData.LoadXml((cipherDataNode as XmlElement)!);
+
+ // EncryptionProperties
+ XmlNode? encryptionPropertiesNode = value.SelectSingleNode("enc:EncryptionProperties", nsm);
+ if (encryptionPropertiesNode != null)
{
- foreach (XmlNode node in encryptionPropertyNodes)
+ // Select the EncryptionProperty elements inside the EncryptionProperties element
+ XmlNodeList? encryptionPropertyNodes = encryptionPropertiesNode.SelectNodes("enc:EncryptionProperty", nsm);
+ if (encryptionPropertyNodes != null)
{
- EncryptionProperty ep = new EncryptionProperty();
- ep.LoadXml((node as XmlElement)!);
- EncryptionProperties.Add(ep);
+ foreach (XmlNode node in encryptionPropertyNodes)
+ {
+ EncryptionProperty ep = new EncryptionProperty();
+ ep.LoadXml((node as XmlElement)!);
+ EncryptionProperties.Add(ep);
+ }
}
}
- }
- // CarriedKeyName
- XmlNode? carriedKeyNameNode = value.SelectSingleNode("enc:CarriedKeyName", nsm);
- if (carriedKeyNameNode != null)
- {
- CarriedKeyName = carriedKeyNameNode.InnerText;
- }
+ // CarriedKeyName
+ XmlNode? carriedKeyNameNode = value.SelectSingleNode("enc:CarriedKeyName", nsm);
+ if (carriedKeyNameNode != null)
+ {
+ CarriedKeyName = carriedKeyNameNode.InnerText;
+ }
- // ReferenceList
- XmlNode? referenceListNode = value.SelectSingleNode("enc:ReferenceList", nsm);
- if (referenceListNode != null)
- {
- // Select the DataReference elements inside the ReferenceList element
- XmlNodeList? dataReferenceNodes = referenceListNode.SelectNodes("enc:DataReference", nsm);
- if (dataReferenceNodes != null)
+ // ReferenceList
+ XmlNode? referenceListNode = value.SelectSingleNode("enc:ReferenceList", nsm);
+ if (referenceListNode != null)
{
- foreach (XmlNode node in dataReferenceNodes)
+ // Select the DataReference elements inside the ReferenceList element
+ XmlNodeList? dataReferenceNodes = referenceListNode.SelectNodes("enc:DataReference", nsm);
+ if (dataReferenceNodes != null)
{
- DataReference dr = new DataReference();
- dr.LoadXml((node as XmlElement)!);
- ReferenceList.Add(dr);
+ foreach (XmlNode node in dataReferenceNodes)
+ {
+ DataReference dr = new DataReference();
+ dr.LoadXml((node as XmlElement)!);
+ ReferenceList.Add(dr);
+ }
}
- }
- // Select the KeyReference elements inside the ReferenceList element
- XmlNodeList? keyReferenceNodes = referenceListNode.SelectNodes("enc:KeyReference", nsm);
- if (keyReferenceNodes != null)
- {
- foreach (XmlNode node in keyReferenceNodes)
+ // Select the KeyReference elements inside the ReferenceList element
+ XmlNodeList? keyReferenceNodes = referenceListNode.SelectNodes("enc:KeyReference", nsm);
+ if (keyReferenceNodes != null)
{
- KeyReference kr = new KeyReference();
- kr.LoadXml((node as XmlElement)!);
- ReferenceList.Add(kr);
+ foreach (XmlNode node in keyReferenceNodes)
+ {
+ KeyReference kr = new KeyReference();
+ kr.LoadXml((node as XmlElement)!);
+ ReferenceList.Add(kr);
+ }
}
}
- }
- // Save away the cached value
- _cachedXml = value;
+ // Save away the cached value
+ _cachedXml = value;
+ }
+ finally
+ {
+ DecrementLoadXmlCurrentThreadDepth();
+ }
}
public override XmlElement GetXml()
diff --git a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedType.cs b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedType.cs
index 29aa30afacfec7..bfcc117f1d0a46 100644
--- a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedType.cs
+++ b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedType.cs
@@ -1,6 +1,7 @@
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.
+using System.Diagnostics;
using System.Diagnostics.CodeAnalysis;
using System.Xml;
@@ -8,6 +9,9 @@ namespace System.Security.Cryptography.Xml
{
public abstract class EncryptedType
{
+ [ThreadStatic]
+ private static int t_depth;
+
private string? _id;
private string? _type;
private string? _mimeType;
@@ -74,6 +78,24 @@ public KeyInfo KeyInfo
set => _keyInfo = value;
}
+ internal static void IncrementLoadXmlCurrentThreadDepth()
+ {
+ Debug.Assert(t_depth >= 0, "LoadXml current thread depth is negative.");
+ int maxDepth = LocalAppContextSwitches.DangerousMaxRecursionDepth;
+ if (maxDepth > 0 && t_depth > maxDepth)
+ {
+ throw new CryptographicException(SR.Cryptography_Xml_MaxDepthExceeded);
+ }
+
+ t_depth++;
+ }
+
+ internal static void DecrementLoadXmlCurrentThreadDepth()
+ {
+ Debug.Assert(t_depth > 0, "LoadXml current thread depth is already 0.");
+ t_depth--;
+ }
+
public virtual EncryptionMethod? EncryptionMethod
{
get { return _encryptionMethod; }
diff --git a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedXml.cs b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedXml.cs
index 1e42b3a73ac9ee..05d0fbb8d18eac 100644
--- a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedXml.cs
+++ b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/EncryptedXml.cs
@@ -2,6 +2,7 @@
// The .NET Foundation licenses this file to you under the MIT license.
using System.Collections;
+using System.Collections.Generic;
using System.Diagnostics.CodeAnalysis;
using System.IO;
using System.Security.Cryptography.X509Certificates;
@@ -73,6 +74,9 @@ public class EncryptedXml
private int _xmlDsigSearchDepthCounter;
private int _xmlDsigSearchDepth;
+ // Built in transform algorithm URIs
+ private static IList? s_defaultSafeTransformMethods;
+
//
// public constructors
//
@@ -212,6 +216,11 @@ private byte[] GetCipherValue(CipherData cipherData)
{
throw new CryptographicException(SR.Cryptography_Xml_UriNotSupported);
}
+ if (!ReferenceUsesSafeTransformMethods(cipherData.CipherReference))
+ {
+ throw new CryptographicException(SR.Cryptography_Xml_NotSupportedCryptographicTransform);
+ }
+
decInputStream = tc.TransformToOctetStream(_document, _xmlResolver, baseUri);
}
else if (cipherData.CipherReference.Uri[0] == '#')
@@ -230,6 +239,11 @@ private byte[] GetCipherValue(CipherData cipherData)
{
throw new CryptographicException(SR.Cryptography_Xml_UriNotSupported);
}
+ if (!ReferenceUsesSafeTransformMethods(cipherData.CipherReference))
+ {
+ throw new CryptographicException(SR.Cryptography_Xml_NotSupportedCryptographicTransform);
+ }
+
decInputStream = tc.TransformToOctetStream(inputStream, _xmlResolver, baseUri);
}
else
@@ -1019,5 +1033,69 @@ public static byte[] DecryptKey(byte[] keyData, RSA rsa, bool useOAEP)
return rsaDeformatter.DecryptKeyExchange(keyData);
}
}
+
+ private static bool ReferenceUsesSafeTransformMethods(CipherReference reference)
+ {
+ // If the app context switch to enforce safe transforms is not enabled,
+ // then we consider all transforms to be safe.
+ if (LocalAppContextSwitches.AllowDangerousEncryptedXmlTransforms)
+ {
+ return true;
+ }
+
+ TransformChain transformChain = reference.TransformChain;
+ int transformCount = transformChain.Count;
+
+ for (int i = 0; i < transformCount; i++)
+ {
+ Transform transform = transformChain[i];
+
+ if (!IsSafeTransform(transform.Algorithm!))
+ {
+ return false;
+ }
+ }
+
+ return true;
+ }
+
+ private static bool IsSafeTransform(string transformAlgorithm)
+ {
+ foreach (string safeAlgorithm in DefaultSafeTransformMethods)
+ {
+ if (string.Equals(safeAlgorithm, transformAlgorithm, StringComparison.OrdinalIgnoreCase))
+ {
+ return true;
+ }
+ }
+
+ return false;
+ }
+
+ private static IList DefaultSafeTransformMethods
+ {
+ get
+ {
+ if (s_defaultSafeTransformMethods == null)
+ {
+ List safeAlgorithms = new List();
+
+ // Built in canonicalization algorithms
+ safeAlgorithms.Add(SignedXml.XmlDsigC14NTransformUrl);
+ safeAlgorithms.Add(SignedXml.XmlDsigC14NWithCommentsTransformUrl);
+ safeAlgorithms.Add(SignedXml.XmlDsigExcC14NTransformUrl);
+ safeAlgorithms.Add(SignedXml.XmlDsigExcC14NWithCommentsTransformUrl);
+
+ // Other built in transform algorithms
+ safeAlgorithms.Add(SignedXml.XmlDsigBase64TransformUrl);
+ safeAlgorithms.Add(SignedXml.XmlLicenseTransformUrl);
+ safeAlgorithms.Add(SignedXml.XmlDecryptionTransformUrl);
+
+ s_defaultSafeTransformMethods = safeAlgorithms;
+ }
+
+ return s_defaultSafeTransformMethods;
+ }
+ }
}
}
diff --git a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/KeyInfo.cs b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/KeyInfo.cs
index 2beaa3eb31dbbb..82687d987f1330 100644
--- a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/KeyInfo.cs
+++ b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/KeyInfo.cs
@@ -67,48 +67,56 @@ public void LoadXml(XmlElement value)
throw new ArgumentNullException(nameof(value));
}
- XmlElement keyInfoElement = value;
- _id = Utils.GetAttribute(keyInfoElement, "Id", SignedXml.XmlDsigNamespaceUrl);
- if (!Utils.VerifyAttributes(keyInfoElement, "Id"))
- throw new CryptographicException(SR.Cryptography_Xml_InvalidElement, "KeyInfo");
-
- XmlNode? child = keyInfoElement.FirstChild;
- while (child != null)
+ EncryptedType.IncrementLoadXmlCurrentThreadDepth();
+ try
{
- XmlElement? elem = child as XmlElement;
- if (elem != null)
+ XmlElement keyInfoElement = value;
+ _id = Utils.GetAttribute(keyInfoElement, "Id", SignedXml.XmlDsigNamespaceUrl);
+ if (!Utils.VerifyAttributes(keyInfoElement, "Id"))
+ throw new CryptographicException(SR.Cryptography_Xml_InvalidElement, "KeyInfo");
+
+ XmlNode? child = keyInfoElement.FirstChild;
+ while (child != null)
{
- // Create the right type of KeyInfoClause; we use a combination of the namespace and tag name (local name)
- string kicString = elem.NamespaceURI + " " + elem.LocalName;
- // Special-case handling for KeyValue -- we have to go one level deeper
- if (kicString == "http://www.w3.org/2000/09/xmldsig# KeyValue")
+ XmlElement? elem = child as XmlElement;
+ if (elem != null)
{
- if (!Utils.VerifyAttributes(elem, (string[]?)null))
+ // Create the right type of KeyInfoClause; we use a combination of the namespace and tag name (local name)
+ string kicString = elem.NamespaceURI + " " + elem.LocalName;
+ // Special-case handling for KeyValue -- we have to go one level deeper
+ if (kicString == "http://www.w3.org/2000/09/xmldsig# KeyValue")
{
- throw new CryptographicException(SR.Cryptography_Xml_InvalidElement, "KeyInfo/KeyValue");
- }
- XmlNodeList nodeList2 = elem.ChildNodes;
- foreach (XmlNode node2 in nodeList2)
- {
- XmlElement? elem2 = node2 as XmlElement;
- if (elem2 != null)
+ if (!Utils.VerifyAttributes(elem, (string[]?)null))
+ {
+ throw new CryptographicException(SR.Cryptography_Xml_InvalidElement, "KeyInfo/KeyValue");
+ }
+ XmlNodeList nodeList2 = elem.ChildNodes;
+ foreach (XmlNode node2 in nodeList2)
{
- kicString += "/" + elem2.LocalName;
- break;
+ XmlElement? elem2 = node2 as XmlElement;
+ if (elem2 != null)
+ {
+ kicString += "/" + elem2.LocalName;
+ break;
+ }
}
}
- }
- KeyInfoClause? keyInfoClause = CryptoHelpers.CreateNonTransformFromName(kicString);
- // if we don't know what kind of KeyInfoClause we're looking at, use a generic KeyInfoNode:
- keyInfoClause ??= new KeyInfoNode();
+ KeyInfoClause? keyInfoClause = CryptoHelpers.CreateNonTransformFromName(kicString);
+ // if we don't know what kind of KeyInfoClause we're looking at, use a generic KeyInfoNode:
+ keyInfoClause ??= new KeyInfoNode();
- // Ask the create clause to fill itself with the corresponding XML
- keyInfoClause.LoadXml(elem);
- // Add it to our list of KeyInfoClauses
- AddClause(keyInfoClause);
+ // Ask the create clause to fill itself with the corresponding XML
+ keyInfoClause.LoadXml(elem);
+ // Add it to our list of KeyInfoClauses
+ AddClause(keyInfoClause);
+ }
+ child = child.NextSibling;
}
- child = child.NextSibling;
+ }
+ finally
+ {
+ EncryptedType.DecrementLoadXmlCurrentThreadDepth();
}
}
diff --git a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/LocalAppContextSwitches.cs b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/LocalAppContextSwitches.cs
new file mode 100644
index 00000000000000..16a7a9f95bcde8
--- /dev/null
+++ b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/LocalAppContextSwitches.cs
@@ -0,0 +1,76 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Globalization;
+
+namespace System
+{
+ internal static partial class LocalAppContextSwitches
+ {
+ internal const int DefaultMaxDecryptionDepth = 64;
+ internal const string DangerousMaxRecursionDepthAppContextSwitch = "System.Security.Cryptography.Xml.DangerousMaxRecursionDepth";
+ internal const string AllowDangerousEncryptedXmlTransformsAppContextSwitch = "System.Security.Cryptography.Xml.AllowDangerousEncryptedXmlTransforms";
+
+ ///
+ /// Gets the maximum recursion depth for recursive XML operations.
+ /// Configurable via AppContext data "System.Security.Cryptography.Xml.DangerousMaxRecursionDepth".
+ /// Default value is 64. A value of 0 means infinite (no limit).
+ ///
+ internal static int DangerousMaxRecursionDepth { get; } =
+ GetInt32Config(DangerousMaxRecursionDepthAppContextSwitch, DefaultMaxDecryptionDepth, allowNegative: false);
+
+ ///
+ /// Gets whether to enforce safe transforms for XML encryption by default.
+ /// Configurable via AppContext switch "System.Security.Cryptography.Xml.AllowDangerousEncryptedXmlTransforms".
+ /// Default value is false.
+ ///
+ internal static bool AllowDangerousEncryptedXmlTransforms { get; } =
+ GetBooleanConfig(AllowDangerousEncryptedXmlTransformsAppContextSwitch, defaultValue: false);
+
+ ///
+ /// Gets an integer configuration value from AppContext data.
+ ///
+ /// The AppContext data key name.
+ /// The default value if not configured or invalid.
+ /// Whether to allow negative values.
+ /// The configured value or the default.
+ private static int GetInt32Config(string appContextName, int defaultValue, bool allowNegative = true)
+ {
+ object? data = AppContext.GetData(appContextName);
+
+ if (data is null)
+ {
+ return defaultValue;
+ }
+
+ int value;
+
+ try
+ {
+ value = Convert.ToInt32(data, CultureInfo.InvariantCulture);
+ }
+ catch
+ {
+ return defaultValue;
+ }
+
+ return (allowNegative || value >= 0) ? value : defaultValue;
+ }
+
+ ///
+ /// Gets a boolean configuration value from AppContext switch.
+ ///
+ /// The AppContext switch name.
+ /// The default value if not configured or invalid.
+ /// The configured value or the default.
+ private static bool GetBooleanConfig(string appContextName, bool defaultValue)
+ {
+ if (AppContext.TryGetSwitch(appContextName, out bool isEnabled))
+ {
+ return isEnabled;
+ }
+
+ return defaultValue;
+ }
+ }
+}
diff --git a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/XmlDecryptionTransform.cs b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/XmlDecryptionTransform.cs
index 9633e0111c71a5..fc3326bc610dc3 100644
--- a/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/XmlDecryptionTransform.cs
+++ b/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/XmlDecryptionTransform.cs
@@ -2,6 +2,7 @@
// The .NET Foundation licenses this file to you under the MIT license.
using System.Collections;
+using System.Collections.Generic;
using System.Diagnostics.CodeAnalysis;
using System.IO;
using System.Xml;
@@ -221,15 +222,19 @@ private void ProcessElementRecursively(XmlNodeList encryptedDatas)
{
if (encryptedDatas == null || encryptedDatas.Count == 0)
return;
- Queue encryptedDatasQueue = new Queue();
+ int maxDepth = LocalAppContextSwitches.DangerousMaxRecursionDepth;
+ Queue encryptedDatasQueue = new();
foreach (XmlNode value in encryptedDatas)
{
- encryptedDatasQueue.Enqueue(value);
+ encryptedDatasQueue.Enqueue(new(value, depth: 0));
}
- XmlNode? node = encryptedDatasQueue.Dequeue() as XmlNode;
- while (node != null)
+
+ while (encryptedDatasQueue.Count > 0)
{
- XmlElement? encryptedDataElement = node as XmlElement;
+ ProcessElementWorkItem workItem = encryptedDatasQueue.Dequeue();
+ XmlElement? encryptedDataElement = workItem.Element as XmlElement;
+ int depth = workItem.Depth;
+
if (encryptedDataElement != null && encryptedDataElement.LocalName == "EncryptedData" &&
encryptedDataElement.NamespaceURI == EncryptedXml.XmlEncNamespaceUrl)
{
@@ -246,17 +251,19 @@ private void ProcessElementRecursively(XmlNodeList encryptedDatas)
XmlNodeList nodes = child.SelectNodes("//enc:EncryptedData", _nsm!)!;
if (nodes.Count > 0)
{
+ if (maxDepth > 0 && depth > maxDepth)
+ {
+ throw new CryptographicException(SR.Cryptography_Xml_MaxDepthExceeded);
+ }
+
foreach (XmlNode value in nodes)
{
- encryptedDatasQueue.Enqueue(value);
+ encryptedDatasQueue.Enqueue(new(value, depth + 1));
}
}
}
}
}
- if (encryptedDatasQueue.Count == 0)
- break;
- node = encryptedDatasQueue.Dequeue() as XmlNode;
}
}
@@ -277,5 +284,11 @@ public override object GetOutput(Type type)
else
throw new ArgumentException(SR.Cryptography_Xml_TransformIncorrectInputType, nameof(type));
}
+
+ private readonly struct ProcessElementWorkItem(XmlNode element, int depth)
+ {
+ public readonly XmlNode Element = element;
+ public readonly int Depth = depth;
+ }
}
}
diff --git a/src/libraries/System.Security.Cryptography.Xml/tests/EncryptedXmlSample4.xml b/src/libraries/System.Security.Cryptography.Xml/tests/EncryptedXmlSample4.xml
new file mode 100644
index 00000000000000..585a61ecdbe527
--- /dev/null
+++ b/src/libraries/System.Security.Cryptography.Xml/tests/EncryptedXmlSample4.xml
@@ -0,0 +1,1994 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+