XmlReaderSettings 类

定义

public ref class XmlReaderSettings sealed

public sealed class XmlReaderSettings

type XmlReaderSettings = class

Public NotInheritable Class XmlReaderSettings

继承

Object

XmlReaderSettings

示例

下面的示例创建一个 XmlReader ，它将 XmlUrlResolver 与所需的凭据一起使用。The following example creates an XmlReader that uses an XmlUrlResolver with the necessary credentials.

// Create an XmlUrlResolver with the credentials necessary to access the Web server.
var resolver = new XmlUrlResolver();
var myCred = new NetworkCredential(UserName, SecurelyStoredPassword, Domain);
resolver.Credentials = myCred;

var settings = new XmlReaderSettings();
settings.XmlResolver = resolver;

// Create the reader.
XmlReader reader = XmlReader.Create("http://serverName/data/books.xml", settings);

' Create an XmlUrlResolver with the credentials necessary to access the Web server.
Dim resolver As New XmlUrlResolver()
Dim myCred As System.Net.NetworkCredential
myCred = New System.Net.NetworkCredential(UserName, SecurelyStoredPassword, Domain)
resolver.Credentials = myCred

Dim settings As New XmlReaderSettings()
settings.XmlResolver = resolver

' Create the reader.
Dim reader As XmlReader = XmlReader.Create("http://serverName/data/books.xml", settings)

注解

使用 Create 方法获取 XmlReader 实例。You use the Create method to obtain XmlReader instances. 此方法使用 XmlReaderSettings 类指定在其创建的对象中实现哪些功能 XmlReader 。This method uses the XmlReaderSettings class to specify which features to implement in the XmlReader object it creates.

请参阅和参考页的 "备注" 部分，了解 XmlReader Create 要用于一致性检查、验证和其他常见方案的设置。See the Remarks sections of the XmlReader and Create reference pages for information about which settings to use for conformance checks, validation, and other common scenarios. XmlReaderSettings()有关默认设置的列表，请参见构造函数。See the XmlReaderSettings() constructor for a list of default settings.

安全注意事项Security considerations

使用类时，请注意以下事项 XmlReaderSettings 。Consider the following when using the XmlReaderSettings class.

• 默认情况下不设置 ProcessInlineSchema 对象的 ProcessSchemaLocation 和 XmlReaderSettings 验证标志。The ProcessInlineSchema and ProcessSchemaLocation validation flags of an XmlReaderSettings object are not set by default. 设置了这些标志后，XmlResolver 对象的 XmlReaderSettings 用于在 XmlReader 中解析实例文档中遇到的架构位置。When these flags are set, the XmlResolver of the XmlReaderSettings object is used to resolve schema locations encountered in the instance document in the XmlReader. 如果 XmlResolver 对象为 null ，则即使 ProcessInlineSchema 设置了和验证标志，也不会解析架构位置 ProcessSchemaLocation 。If the XmlResolver object is null, schema locations are not resolved even if the ProcessInlineSchema and ProcessSchemaLocation validation flags are set.

• 在验证过程中添加的架构会添加新类型，并且可能更改被验证的文档的验证结果。Schemas added during validation add new types and can change the validation outcome of the document being validated. 因此，只应从可信的源解析外部架构。As a result, external schemas should only be resolved from trusted sources.

• 验证错误消息可能会暴露敏感内容模型信息。Validation error messages may expose sensitive content model information. 使用委托处理验证错误和警告消息 ValidationEventHandler ， XmlSchemaValidationException 如果不向对象提供任何事件处理程序 XmlReaderSettings (验证警告不会导致) 引发，则将使用委托来处理验证错误和警告消息 XmlSchemaValidationException 。Validation error and warning messages are handled using the ValidationEventHandler delegate, or are exposed as an XmlSchemaValidationException if no event handler is provided to the XmlReaderSettings object (validation warnings do not cause an XmlSchemaValidationException to be thrown). 不受信任的情况下不应公开此内容模型信息。This content model information should not be exposed in untrusted scenarios. 默认情况下，会禁止显示验证警告消息，并可通过设置标志来报告验证警告消息 ReportValidationWarnings 。Validation warning messages are suppressed by default and can be reported by setting the ReportValidationWarnings flag.

• 的 SourceUri 属性将 XmlSchemaValidationException 返回引发异常的架构文件的 URI 路径。The SourceUri property of an XmlSchemaValidationException returns the URI path to the schema file that caused the exception. SourceUri不应在不受信任的方案中公开属性。The SourceUri property should not be exposed in untrusted scenarios.

• ProcessIdentityConstraints如果在高可用性方案中针对文档的一个具有标识约束的架构验证、不受信任的大型 XML 文档，则建议禁用 (默认启用) 标志。Disabling the ProcessIdentityConstraints flag (enabled by default) is recommended when validating, untrusted, large XML documents in high availability scenarios against a schema with identity constraints over a large part of the document.

• XmlReaderSettings 对象可以包含敏感信息，例如用户凭据。XmlReaderSettings objects can contain sensitive information such as user credentials. 在缓存 XmlReaderSettings 对象时，或在将 XmlReaderSettings 对象从一个组件传递到另一个组件时，应小心。You should be careful when caching XmlReaderSettings objects, or when passing the XmlReaderSettings object from one component to another.

• 默认情况下禁用 DTD 处理。DTD processing is disabled by default. 如果启用 DTD 处理，则需要注意包含来自不受信任源的 Dtd 以及可能的拒绝服务攻击。If you enable DTD processing, you need to be aware of including DTDs from untrusted sources and possible denial of service attacks. 使用 XmlSecureResolver 限制 XmlReader 可以访问的资源。Use the XmlSecureResolver to restrict the resources that the XmlReader can access.

• 不接受来自不可信的源的支持组件，例如 NameTable、XmlNamespaceManager 和 XmlResolver 对象。Do not accept supporting components, such as NameTable, XmlNamespaceManager, and XmlResolver objects, from an untrusted source.

• 使用 XmlReader 的应用程序的内存使用量可能与分析的 XML 文档的大小有关。Memory usage of an application that uses XmlReader may have a correlation to the size of the parsed XML document. 拒绝服务攻击的一种形式是提交过大的 XML 文档进行分析。One form of denial of service attack is when excessively large XML documents are submitted to be parsed. 可以通过设置属性来限制可分析的文档大小 MaxCharactersInDocument ，并通过设置属性来限制通过扩展实体而产生的字符数 MaxCharactersFromEntities 。You can limit the size of the document that can be parsed by setting the MaxCharactersInDocument property and then limit the number of characters that result from expanding entities by setting the MaxCharactersFromEntities property.

构造函数

属性

方法

事件

适用于

另请参阅

• XML 文档和数据XML Documents and Data