XmlReaderSettings 类

定义

public ref class XmlReaderSettings sealed

public sealed class XmlReaderSettings

type XmlReaderSettings = class

Public NotInheritable Class XmlReaderSettings

继承

Object

XmlReaderSettings

示例

下面的示例创建一个XmlReader , 它将XmlUrlResolver与所需的凭据一起使用。The following example creates an XmlReader that uses an XmlUrlResolver with the necessary credentials.

// Create an XmlUrlResolver with the credentials necessary to access the Web server.
XmlUrlResolver resolver = new XmlUrlResolver();
System.Net.NetworkCredential myCred;
myCred  = new System.Net.NetworkCredential(UserName,SecurelyStoredPassword,Domain);  
resolver.Credentials = myCred;

XmlReaderSettings settings = new XmlReaderSettings();
settings.XmlResolver = resolver;

// Create the reader.
XmlReader reader = XmlReader.Create("http://serverName/data/books.xml", settings);

' Create an XmlUrlResolver with the credentials necessary to access the Web server.
Dim resolver As New XmlUrlResolver()
Dim myCred As System.Net.NetworkCredential
myCred = New System.Net.NetworkCredential(UserName, SecurelyStoredPassword, Domain)
resolver.Credentials = myCred

Dim settings As New XmlReaderSettings()
settings.XmlResolver = resolver

' Create the reader.
Dim reader As XmlReader = XmlReader.Create("http://serverName/data/books.xml", settings)

注解

使用Create方法获取XmlReader实例。You use the Create method to obtain XmlReader instances. 此方法使用XmlReaderSettings类指定在其创建的XmlReader对象中实现哪些功能。This method uses the XmlReaderSettings class to specify which features to implement in the XmlReader object it creates.

请参阅XmlReader和Create参考页的 "备注" 部分, 了解要用于一致性检查、验证和其他常见方案的设置。See the Remarks sections of the XmlReader and Create reference pages for information about which settings to use for conformance checks, validation, and other common scenarios. 有关默认设置的列表, 请参见构造函数。XmlReaderSettings()See the XmlReaderSettings() constructor for a list of default settings.

安全注意事项Security considerations

使用XmlReaderSettings类时, 请注意以下事项。Consider the following when using the XmlReaderSettings class.

• 默认情况下不设置 ProcessInlineSchema 对象的 ProcessSchemaLocation 和 XmlReaderSettings 验证标志。The ProcessInlineSchema and ProcessSchemaLocation validation flags of an XmlReaderSettings object are not set by default. 设置了这些标志后，XmlResolver 对象的 XmlReaderSettings 用于在 XmlReader 中解析实例文档中遇到的架构位置。When these flags are set, the XmlResolver of the XmlReaderSettings object is used to resolve schema locations encountered in the instance document in the XmlReader. 如果对象为null, 则即使设置了ProcessInlineSchema和ProcessSchemaLocation验证标志, 也不会解析架构位置。 XmlResolverIf the XmlResolver object is null, schema locations are not resolved even if the ProcessInlineSchema and ProcessSchemaLocation validation flags are set.

• 在验证过程中添加的架构会添加新类型，并且可能更改被验证的文档的验证结果。Schemas added during validation add new types and can change the validation outcome of the document being validated. 因此，只应从可信的源解析外部架构。As a result, external schemas should only be resolved from trusted sources.

• 验证错误消息可能会暴露敏感内容模型信息。Validation error messages may expose sensitive content model information. 使用ValidationEventHandler委托处理验证错误和警告消息, XmlSchemaValidationException如果不向XmlReaderSettings XmlSchemaValidationException对象提供任何事件处理程序, 则会将其公开为 (验证警告不会导致引发)。Validation error and warning messages are handled using the ValidationEventHandler delegate, or are exposed as an XmlSchemaValidationException if no event handler is provided to the XmlReaderSettings object (validation warnings do not cause an XmlSchemaValidationException to be thrown). 不受信任的情况下不应公开此内容模型信息。This content model information should not be exposed in untrusted scenarios. 默认情况下, 会禁止显示验证警告消息, 并可通过ReportValidationWarnings设置标志来报告验证警告消息。Validation warning messages are suppressed by default and can be reported by setting the ReportValidationWarnings flag.

• 的SourceUri 属性XmlSchemaValidationException将返回引发异常的架构文件的 URI 路径。The SourceUri property of an XmlSchemaValidationException returns the URI path to the schema file that caused the exception. 不SourceUri应在不受信任的方案中公开属性。The SourceUri property should not be exposed in untrusted scenarios.

• 如果在高可用性方案中针对包含对文档大部分的标识约束的架构验证、不受信任的大型 XML 文档, 则建议禁用标志(默认启用)。ProcessIdentityConstraintsDisabling the ProcessIdentityConstraints flag (enabled by default) is recommended when validating, untrusted, large XML documents in high availability scenarios against a schema with identity constraints over a large part of the document.

• XmlReaderSettings 对象可以包含敏感信息，例如用户凭据。XmlReaderSettings objects can contain sensitive information such as user credentials. 在缓存 XmlReaderSettings 对象时，或在将 XmlReaderSettings 对象从一个组件传递到另一个组件时，应小心。You should be careful when caching XmlReaderSettings objects, or when passing the XmlReaderSettings object from one component to another.

• 默认情况下禁用 DTD 处理。DTD processing is disabled by default. 如果启用 DTD 处理, 则需要注意包含来自不受信任源的 Dtd 以及可能的拒绝服务攻击。If you enable DTD processing, you need to be aware of including DTDs from untrusted sources and possible denial of service attacks. 使用限制XmlReader可以访问的资源。 XmlSecureResolverUse the XmlSecureResolver to restrict the resources that the XmlReader can access.

• 不接受来自不可信的源的支持组件，例如 NameTable、XmlNamespaceManager 和 XmlResolver 对象。Do not accept supporting components, such as NameTable, XmlNamespaceManager, and XmlResolver objects, from an untrusted source.

• 使用 XmlReader 的应用程序的内存使用量可能与分析的 XML 文档的大小有关。Memory usage of an application that uses XmlReader may have a correlation to the size of the parsed XML document. 拒绝服务攻击的一种形式是提交过大的 XML 文档进行分析。One form of denial of service attack is when excessively large XML documents are submitted to be parsed. 可以通过设置MaxCharactersInDocument属性来限制可分析的文档大小, 并通过MaxCharactersFromEntities设置属性来限制通过扩展实体而产生的字符数。You can limit the size of the document that can be parsed by setting the MaxCharactersInDocument property and then limit the number of characters that result from expanding entities by setting the MaxCharactersFromEntities property.

构造函数

属性

方法

事件

适用于

另请参阅

• XML 文档和数据XML Documents and Data