@@ -59,35 +59,43 @@ public override Message ReadMessage(ArraySegment<byte> buffer, BufferManager buf
59
59
60
60
public override Message ReadMessage ( Stream stream , int maxSizeOfHeaders , string contentType )
61
61
{
62
- var sr = new StreamReader ( stream ) ;
63
- var wireResponse = sr . ReadToEnd ( ) ;
64
- sr . Close ( ) ;
62
+ String wireResponse ;
65
63
64
+ using ( var sr = new StreamReader ( stream ) )
65
+ {
66
+ wireResponse = sr . ReadToEnd ( ) ;
67
+ }
68
+
66
69
// Fix for Xml external entity injection violation in fortify report
67
70
XmlReaderSettings settings = new XmlReaderSettings ( ) ;
68
71
settings . DtdProcessing = DtdProcessing . Prohibit ;
69
72
settings . XmlResolver = null ;
70
73
71
74
XmlDocument doc = new XmlDocument ( ) ;
72
- StringReader stringReader = new StringReader ( wireResponse ) ;
73
- XmlReader reader = XmlReader . Create ( stringReader , settings ) ;
74
- doc . Load ( reader ) ;
75
- //We need to get rid of the security header because it is not signed by the web service.
76
- //The whole reason for the custom Encoder is to do this. the client rejected the unsigned header.
77
- //Our WCF client is set up to allow the absence of a security header but if the header exists then it must be signed.
78
- //Hopefully the namespace will not change. Maybe it should be put in a config.
79
- XPathNavigator n = doc . CreateNavigator ( ) ;
80
- if ( n . MoveToFollowing ( "Security" , "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" ) )
75
+ Message returnMessage = null ;
76
+
77
+ using ( StringReader stringReader = new StringReader ( wireResponse ) )
81
78
{
82
- n . DeleteSelf ( ) ;
79
+ using ( XmlReader reader = XmlReader . Create ( stringReader , settings ) )
80
+ {
81
+ doc . Load ( reader ) ;
82
+
83
+ //We need to get rid of the security header because it is not signed by the web service.
84
+ //The whole reason for the custom Encoder is to do this. the client rejected the unsigned header.
85
+ //Our WCF client is set up to allow the absence of a security header but if the header exists then it must be signed.
86
+ //Hopefully the namespace will not change. Maybe it should be put in a config.
87
+
88
+ XPathNavigator n = doc . CreateNavigator ( ) ;
89
+ if ( n . MoveToFollowing ( "Security" , "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" ) )
90
+ {
91
+ n . DeleteSelf ( ) ;
92
+ }
93
+
94
+ StringReader stringReaderInnerXml = new StringReader ( doc . InnerXml ) ;
95
+ XmlReader reader2 = XmlReader . Create ( stringReaderInnerXml , settings ) ;
96
+ returnMessage = Message . CreateMessage ( reader2 , maxSizeOfHeaders , MessageVersion . Soap11 ) ;
97
+ }
83
98
}
84
- StringReader stringReaderInnerXml = new StringReader ( doc . InnerXml ) ;
85
- reader = XmlReader . Create ( stringReaderInnerXml , settings ) ;
86
- Message returnMessage = Message . CreateMessage ( reader , maxSizeOfHeaders , MessageVersion . Soap11 ) ;
87
-
88
- stringReader . Close ( ) ;
89
- stringReaderInnerXml . Close ( ) ;
90
- reader . Close ( ) ;
91
99
92
100
return returnMessage ;
93
101
}
0 commit comments