// [CRUCIBLE-SEED]
// category: xxe
// severity: critical
// language: csharp
// expected: XXE via XmlReader without secure settings (DtdProcessing.Parse enabled)

using System.Xml;
using Microsoft.AspNetCore.Mvc;

namespace App.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class XmlImportController : ControllerBase
    {
        [HttpPost]
        public IActionResult Import()
        {
            // Vulnerable: default XmlReaderSettings allows DTD and external entities
            var settings = new XmlReaderSettings
            {
                DtdProcessing = DtdProcessing.Parse,   // allows DOCTYPE
                XmlResolver   = new XmlUrlResolver()    // resolves external entities
            };
            using var reader = XmlReader.Create(Request.Body, settings);
            var doc = new XmlDocument();
            doc.Load(reader);
            return Ok("Imported " + doc.DocumentElement?.Name);
        }
    }
}