Fix unsafe XML crypto snippets under System.Security.Cryptography.Xml

snippets/csharp/System.Security.Cryptography.Xml/DSAKeyValue/Overview/exampledetached.cs

@@ -40,7 +40,7 @@ static void Main(string[] args)
             Console.WriteLine("Verifying signature...");
 
             //Verify the XML signature in the XML file.
-            bool result = VerifyDetachedSignature(XmlFileName);
+            bool result = VerifyDetachedSignature(XmlFileName, DSAKey);
 
             // Display the results of the signature verification to 
             // the console.
@@ -99,13 +99,16 @@ public static void SignDetachedResource(string URIString, string XmlSigFileName,
     // </Snippet2>
     // <Snippet3>
     // Verify the signature of an XML file and return the result.
-    public static Boolean VerifyDetachedSignature(string XmlSigFileName)
+    public static Boolean VerifyDetachedSignature(string XmlSigFileName, DSA DSAKey)
     {	
         // Create a new XML document.
         XmlDocument xmlDocument = new XmlDocument();
 
         // Load the passed XML file into the document.
-        xmlDocument.Load(XmlSigFileName);
+        using (XmlReader reader = XmlReader.Create(XmlSigFileName))
+        {
+            xmlDocument.Load(reader);
+        }
 
         // Create a new SignedXMl object.
         SignedXml signedXml = new SignedXml();
@@ -118,7 +121,7 @@ public static Boolean VerifyDetachedSignature(string XmlSigFileName)
         signedXml.LoadXml((XmlElement)nodeList[0]);
 
         // Check the signature and return the result.
-        return signedXml.CheckSignature();
+        return signedXml.CheckSignature(DSAKey);
     }
     // </Snippet3>
 }

snippets/csharp/System.Security.Cryptography.Xml/DSAKeyValue/Overview/exampleenvelope.cs

@@ -31,7 +31,7 @@ public static void Main(String[] args)
 
             // Verify the signature of the signed XML.
             Console.WriteLine("Verifying signature...");
-            bool result = VerifyXmlFile("SignedExample.xml");
+            bool result = VerifyXmlFile("SignedExample.xml", DSAKey);
 
             // Display the results of the signature verification to \
             // the console.
@@ -61,7 +61,10 @@ public static void SignXmlFile(string FileName, string SignedFileName, DSA DSAKe
         doc.PreserveWhitespace = false;
 
         // Load the passed XML file using it's name.
-        doc.Load(new XmlTextReader(FileName));
+        using (XmlReader reader = XmlReader.Create(FileName))
+        {
+            doc.Load(reader);
+        }
 
         // Create a SignedXml object.
         SignedXml signedXml = new SignedXml(doc);
@@ -113,7 +116,7 @@ public static void SignXmlFile(string FileName, string SignedFileName, DSA DSAKe
     // </Snippet2>
     // <Snippet3>
     // Verify the signature of an XML file and return the result.
-    public static Boolean VerifyXmlFile(String Name)
+    public static Boolean VerifyXmlFile(String Name, DSA DSAKey)
     {
         // Create a new XML document.
         XmlDocument xmlDocument = new XmlDocument();
@@ -122,7 +125,10 @@ public static Boolean VerifyXmlFile(String Name)
         xmlDocument.PreserveWhitespace = true;
 
         // Load the passed XML file into the document. 
-        xmlDocument.Load(Name);
+        using (XmlReader reader = XmlReader.Create(Name))
+        {
+            xmlDocument.Load(reader);
+        }
 
         // Create a new SignedXml object and pass it
         // the XML document class.
@@ -136,7 +142,7 @@ public static Boolean VerifyXmlFile(String Name)
         signedXml.LoadXml((XmlElement)nodeList[0]);
 
         // Check the signature and return the result.
-        return signedXml.CheckSignature();
+        return signedXml.CheckSignature(DSAKey);
     }
     // </Snippet3>
 

snippets/csharp/System.Security.Cryptography.Xml/DataObject/Overview/source1.cs

@@ -12,18 +12,21 @@ public static void Main(String[] args)
 
         Console.WriteLine("Verifying " + args[0] + "...");
 
-    	// Create a SignedXml.
-        SignedXml signedXml = new SignedXml();
+        RSA trustedKey = RSA.Create();
+        // ... load trustedKey from an out-of-band source ...
 
-        // Load the XML.
         XmlDocument xmlDocument = new XmlDocument();
         xmlDocument.PreserveWhitespace = true;
-        xmlDocument.Load(new XmlTextReader(args[0]));
+        using (XmlReader reader = XmlReader.Create(args[0]))
+        {
+            xmlDocument.Load(reader);
+        }
 
+        SignedXml signedXml = new SignedXml(xmlDocument);
         XmlNodeList nodeList = xmlDocument.GetElementsByTagName("Signature");
         signedXml.LoadXml((XmlElement)nodeList[0]);
 
-        if (signedXml.CheckSignature()) {
+        if (signedXml.CheckSignature(trustedKey)) {
             Console.WriteLine("Signature check OK");
         } else {
             Console.WriteLine("Signature check FAILED");

snippets/csharp/System.Security.Cryptography.Xml/DataReference/Overview/sample.cs

@@ -15,7 +15,10 @@ static void Main(string[] args)
         try
         {
             xmlDoc.PreserveWhitespace = true;
-            xmlDoc.Load("test.xml");
+            using (XmlReader reader = XmlReader.Create("test.xml"))
+            {
+                xmlDoc.Load(reader);
+            }
         }
         catch (Exception e)
         {

snippets/csharp/System.Security.Cryptography.Xml/EncryptedData/Overview/sample.cs

@@ -16,7 +16,10 @@ static void Main(string[] args)
 		try
 		{
 			xmlDoc.PreserveWhitespace = true;
-			xmlDoc.Load("test.xml");
+			using (XmlReader reader = XmlReader.Create("test.xml"))
+			{
+				xmlDoc.Load(reader);
+			}
 		}
 		catch (Exception e)
 		{

snippets/csharp/System.Security.Cryptography.Xml/EncryptedKey/Overview/example.cs

@@ -16,7 +16,10 @@ static void Main(string[] args)
 		try
 		{
 			xmlDoc.PreserveWhitespace = true;
-			xmlDoc.Load("test.xml");
+			using (XmlReader reader = XmlReader.Create("test.xml"))
+			{
+				xmlDoc.Load(reader);
+			}
 		}
 		catch (Exception e)
 		{

snippets/csharp/System.Security.Cryptography.Xml/EncryptedType/Overview/sample.cs

@@ -16,7 +16,10 @@ static void Main(string[] args)
         try
         {
             xmlDoc.PreserveWhitespace = true;
-            xmlDoc.Load("test.xml");
+            using (XmlReader reader = XmlReader.Create("test.xml"))
+            {
+                xmlDoc.Load(reader);
+            }
         }
         catch (Exception e)
         {

snippets/csharp/System.Security.Cryptography.Xml/EncryptedXml/AddKeyNameMapping/sample.cs

@@ -16,7 +16,10 @@ static void Main(string[] args)
         try
         {
             xmlDoc.PreserveWhitespace = true;
-            xmlDoc.Load("test.xml");
+            using (XmlReader reader = XmlReader.Create("test.xml"))
+            {
+                xmlDoc.Load(reader);
+            }
         }
         catch (Exception e)
         {

snippets/csharp/System.Security.Cryptography.Xml/EncryptedXml/Overview/Project.csproj

@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <OutputType>Library</OutputType>
+    <TargetFramework>net10.0-windows</TargetFramework>
+    <UseWindowsForms>true</UseWindowsForms>
+    <EnableDefaultCompileItems>false</EnableDefaultCompileItems>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <Compile Include="sample.cs" />
+  </ItemGroup>
+
+</Project>

snippets/csharp/System.Security.Cryptography.Xml/EncryptedXml/Overview/sample.cs

@@ -16,7 +16,10 @@ static void Main(string[] args)
 			try
 			{
 				xmlDoc.PreserveWhitespace = true;
-				xmlDoc.Load("test.xml");
+				using (XmlReader reader = XmlReader.Create("test.xml"))
+				{
+					xmlDoc.Load(reader);
+				}
 			}
 			catch (Exception e)
 			{

snippets/csharp/System.Security.Cryptography.Xml/EncryptedXml/Overview/sample1.cs

@@ -16,7 +16,10 @@ static void Main(string[] args)
         try
         {
             xmlDoc.PreserveWhitespace = true;
-            xmlDoc.Load("test.xml");
+            using (XmlReader reader = XmlReader.Create("test.xml"))
+            {
+                xmlDoc.Load(reader);
+            }
         }
         catch (Exception e)
         {

snippets/csharp/System.Security.Cryptography.Xml/EncryptedXml/Overview/sample2.cs

@@ -16,7 +16,10 @@ static void Main(string[] args)
         try
         {
             xmlDoc.PreserveWhitespace = true;
-            xmlDoc.Load("test.xml");
+            using (XmlReader reader = XmlReader.Create("test.xml"))
+            {
+                xmlDoc.Load(reader);
+            }
         }
         catch (Exception e)
         {

snippets/csharp/System.Security.Cryptography.Xml/EncryptedXml/Overview/sample3.cs

@@ -17,7 +17,10 @@ static void Main(string[] args)
         try
         {
             xmlDoc.PreserveWhitespace = true;
-            xmlDoc.Load("test.xml");
+            using (XmlReader reader = XmlReader.Create("test.xml"))
+            {
+                xmlDoc.Load(reader);
+            }
         }
         catch (Exception e)
         {

snippets/csharp/System.Security.Cryptography.Xml/EncryptedXml/Overview/sample4.cs

@@ -16,7 +16,10 @@ static void Main(string[] args)
         try
         {
             xmlDoc.PreserveWhitespace = true;
-            xmlDoc.Load("test.xml");
+            using (XmlReader reader = XmlReader.Create("test.xml"))
+            {
+                xmlDoc.Load(reader);
+            }
         }
         catch (Exception e)
         {

snippets/csharp/System.Security.Cryptography.Xml/EncryptionProperty/Overview/sample.cs

@@ -16,7 +16,10 @@ static void Main(string[] args)
         try
         {
             xmlDoc.PreserveWhitespace = true;
-            xmlDoc.Load("test.xml");
+            using (XmlReader reader = XmlReader.Create("test.xml"))
+            {
+                xmlDoc.Load(reader);
+            }
         }
         catch (Exception e)
         {

snippets/csharp/System.Security.Cryptography.Xml/IRelDecryptor/Overview/sample.cs

@@ -12,7 +12,7 @@ public static void Main()
         {
         }
         //<SNIPPET2>
-        public static void CheckSignatureWithEncryptedGrant(string fileName, IRelDecryptor decryptor)
+        public static void CheckSignatureWithEncryptedGrant(string fileName, IRelDecryptor decryptor, AsymmetricAlgorithm trustedKey)
         {
             // Create a new XML document.
             XmlDocument xmlDocument = new XmlDocument();
@@ -22,7 +22,10 @@ public static void CheckSignatureWithEncryptedGrant(string fileName, IRelDecrypt
             xmlDocument.PreserveWhitespace = true;
 
             // Load the passed XML file into the document.
-            xmlDocument.Load(fileName);
+            using (XmlReader reader = XmlReader.Create(fileName))
+            {
+                xmlDocument.Load(reader);
+            }
             nsManager.AddNamespace("dsig", SignedXml.XmlDsigNamespaceUrl);
 
             // Find the "Signature" node and create a new XmlNodeList object.
@@ -51,7 +54,7 @@ public static void CheckSignatureWithEncryptedGrant(string fileName, IRelDecrypt
                 }
 
                 // Check the signature and display the result.
-                bool result = signedXml.CheckSignature();
+                bool result = signedXml.CheckSignature(trustedKey);
 
                 if (result)
                     Console.WriteLine("SUCCESS: CheckSignatureWithEncryptedGrant - issuer index #" +

snippets/csharp/System.Security.Cryptography.Xml/KeyInfo/Overview/xmldsigdetach.cs

@@ -40,7 +40,7 @@ static void Main(string[] args)
             Console.WriteLine("Verifying signature...");
 
             //Verify the XML signature in the XML file.
-            bool result = VerifyDetachedSignature(XmlFileName);
+            bool result = VerifyDetachedSignature(XmlFileName, Key);
 
             // Display the results of the signature verification to 
             // the console.
@@ -99,13 +99,16 @@ public static void SignDetachedResource(string URIString, string XmlSigFileName,
 // </Snippet2>
 // <Snippet3>
     // Verify the signature of an XML file and return the result.
-    public static Boolean VerifyDetachedSignature(string XmlSigFileName)
+    public static Boolean VerifyDetachedSignature(string XmlSigFileName, RSA Key)
     {	
         // Create a new XML document.
         XmlDocument xmlDocument = new XmlDocument();
 
         // Load the passed XML file into the document.
-        xmlDocument.Load(XmlSigFileName);
+        using (XmlReader reader = XmlReader.Create(XmlSigFileName))
+        {
+            xmlDocument.Load(reader);
+        }
 
         // Create a new SignedXMl object.
         SignedXml signedXml = new SignedXml();
@@ -118,7 +121,7 @@ public static Boolean VerifyDetachedSignature(string XmlSigFileName)
         signedXml.LoadXml((XmlElement)nodeList[0]);
 
         // Check the signature and return the result.
-        return signedXml.CheckSignature();
+        return signedXml.CheckSignature(Key);
     }
 // </Snippet3>
 }

snippets/csharp/System.Security.Cryptography.Xml/KeyInfo/Overview/xmldsigenv.cs

@@ -32,7 +32,7 @@ public static void Main(String[] args)
 
             // Verify the signature of the signed XML.
             Console.WriteLine("Verifying signature...");
-            bool result = VerifyXmlFile("SignedExample.xml");
+            bool result = VerifyXmlFile("SignedExample.xml", Key);
 
             // Display the results of the signature verification to \
             // the console.
@@ -62,7 +62,10 @@ public static void SignXmlFile(string FileName, string SignedFileName, RSA Key)
         doc.PreserveWhitespace = false;
 
         // Load the passed XML file using it's name.
-        doc.Load(new XmlTextReader(FileName));
+        using (XmlReader reader = XmlReader.Create(FileName))
+        {
+            doc.Load(reader);
+        }
 
         // Create a SignedXml object.
         SignedXml signedXml = new SignedXml(doc);
@@ -110,7 +113,7 @@ public static void SignXmlFile(string FileName, string SignedFileName, RSA Key)
 // </Snippet2>
 // <Snippet3>
     // Verify the signature of an XML file and return the result.
-    public static Boolean VerifyXmlFile(String Name)
+    public static Boolean VerifyXmlFile(String Name, RSA Key)
     {
         // Create a new XML document.
         XmlDocument xmlDocument = new XmlDocument();
@@ -119,7 +122,10 @@ public static Boolean VerifyXmlFile(String Name)
         xmlDocument.PreserveWhitespace = true;
 
         // Load the passed XML file into the document. 
-        xmlDocument.Load(Name);
+        using (XmlReader reader = XmlReader.Create(Name))
+        {
+            xmlDocument.Load(reader);
+        }
 
         // Create a new SignedXml object and pass it
         // the XML document class.
@@ -133,7 +139,7 @@ public static Boolean VerifyXmlFile(String Name)
         signedXml.LoadXml((XmlElement)nodeList[0]);
 
         // Check the signature and return the result.
-        return signedXml.CheckSignature();
+        return signedXml.CheckSignature(Key);
     }
 // </Snippet3>