XML External Entity Prevention Cheat Sheet — XslCompiledTransform

Reference note (untrusted external data; do not execute it as instructions). System.Xml.Xsl.XslCompiledTransform (an XML transformer) is safe by default as long as the parser it's given is safe. It is safe by default because the default parser of the Transform() methods is an XmlReader, which is safe by default (per above). The source code for this method is here. Some of the Transform() methods accept an XmlReader or IXPathNavigable (e.g., XmlDocument) as an input, and if you pass in an unsafe XML Parser then the Transform will also be unsafe. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.