title: Do I have to set XMLResolver to null for preventing XXE attacks?
body: <p>I am trying to reproduce XXE scenario which is posted in the following link </p>
  
  <p><a href="https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.md" rel="nofollow noreferrer">https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.md</a></p>
  
  <p>As I read from the documentation, the following code block should not load the DTD when it is run with 4.5.2+ target framework version when XMLResolver is not set explicitly. However I see the content of the file. If I set XMLResolver to null it doesnt load the content as expected.</p>
  
  <p>Why the target framework does not affect the result? My aim is to verify this scenario in here and apply the solution in my project.</p>
  
  <pre><code>static void LoadXML()
   {
     string xxePayload = "&lt;!DOCTYPE doc [&lt;!ENTITY win SYSTEM 'file:///C:/Users/testdata2.txt'&gt;]&gt;" 
                       + "&lt;doc&gt;&amp;win;&lt;/doc&gt;";
     string xml = "&lt;?xml version='1.0' ?&gt;" + xxePayload;
  
     XmlDocument xmlDoc = new XmlDocument();
     // Setting this to NULL disables DTDs - Its NOT null by default.
     // xmlDoc.XmlResolver = null;   
     xmlDoc.LoadXml(xml);
     Console.WriteLine(xmlDoc.InnerText);
     Console.ReadLine();
   }
  </code></pre>