wcf - 为什么在使用 .Net WCF 之类的 Web 服务时禁止 DTD 更安全？

Question

在使用 WCF 安全使用 Web 服务的文档中，他们声明建议您在使用元数据时禁止 DTD。为什么 DTD 存在安全风险？

http://msdn.microsoft.com/en-us/library/ms734741.aspx

Answer 1

http://msdn.microsoft.com/en-us/magazine/ee335713.aspx

The easiest way to defend against all types of XML entity attacks is to simply disable altogether the use of inline DTD schemas in your XML parsing objects. This is a straightforward application of the principle of attack surface reduction: if you’re not using a feature, turn it off so that attackers won’t be able to abuse it.