From f2f5f54abc5a7a652aa09059c4a5a504b80072d0 Mon Sep 17 00:00:00 2001
From: Cinder Roxley <cinder@cinderblocks.biz>
Date: Fri, 28 Jun 2024 20:22:46 -0500
Subject: [PATCH] Process XML with XmlReaderSettings. Should mitigate #89,
 LLSD-XML does not specify DTD so any DTD should be ignored not parsed.

---
 LibreMetaverse.StructuredData/LLSD/XmlLLSD.cs  |  2 +-
 LibreMetaverse/Rendering/LindenSkeleton.Ext.cs | 10 +++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/LibreMetaverse.StructuredData/LLSD/XmlLLSD.cs b/LibreMetaverse.StructuredData/LLSD/XmlLLSD.cs
index b5b02056..842f15c2 100644
--- a/LibreMetaverse.StructuredData/LLSD/XmlLLSD.cs
+++ b/LibreMetaverse.StructuredData/LLSD/XmlLLSD.cs
@@ -67,7 +67,7 @@ namespace OpenMetaverse.StructuredData
                 IgnoreProcessingInstructions = false,
                 DtdProcessing = DtdProcessing.Ignore
             };
-            using (XmlReader xrd = XmlReader.Create(xmlStream))
+            using (XmlReader xrd = XmlReader.Create(xmlStream, settings))
             {
                 return DeserializeLLSDXml(xrd);
             }
diff --git a/LibreMetaverse/Rendering/LindenSkeleton.Ext.cs b/LibreMetaverse/Rendering/LindenSkeleton.Ext.cs
index c3b6b653..2bc29740 100644
--- a/LibreMetaverse/Rendering/LindenSkeleton.Ext.cs
+++ b/LibreMetaverse/Rendering/LindenSkeleton.Ext.cs
@@ -72,8 +72,16 @@ namespace OpenMetaverse.Rendering
 
             LindenSkeleton result;
 
+            XmlReaderSettings readerSettings = new XmlReaderSettings
+            {
+                ValidationType = ValidationType.None,
+                CheckCharacters = false,
+                IgnoreComments = true,
+                IgnoreProcessingInstructions = false,
+                DtdProcessing = DtdProcessing.Ignore
+            };
             using (FileStream skeletonData = new FileStream(fileName, FileMode.Open, FileAccess.Read))
-            using (XmlReader reader = XmlReader.Create(skeletonData))
+            using (XmlReader reader = XmlReader.Create(skeletonData, readerSettings))
             {
                 XmlSerializer ser = new XmlSerializer(typeof(LindenSkeleton));
                 result = (LindenSkeleton)ser.Deserialize(reader);