Follow-up: orphan XXE 04f487b5 (dime T1) #244

Origin

Dime Ultrareview cycle-1 on PR #241 (fix/device-validation-level-hardening), tracked finding T1 — surfaced by the security-audit agent.

Finding

Commit 04f487b5 on the branch's ancestry (or the equivalent XML-parser initialisation site on a peer surface) leaves an XML-external-entity (XXE) processing path enabled without an explicit disable. On .NET Framework targets (net461/.../net48), XmlReaderSettings.DtdProcessing defaults to Prohibit since 4.5.2 — but any XmlDocument or XmlTextReader construction that does not explicitly set DtdProcessing = DtdProcessing.Prohibit (or XmlResolver = null) still inherits the pre-4.5.2 permissive default when instantiated indirectly (for example via an XSLT stylesheet load, or a XmlSerializer constructed from an XML fragment).

Rationale for defer

The security-audit finding is orphan to PR #241's scope — the diff does not touch the XML-parser surface — so the fix belongs in its own PR rather than complicating a device-validation-level refactor. Landing atomically here would violate PR-scope hygiene (CONVENTIONS §1.8).

Suggested fix (for the follow-up PR)

Sweep every XmlDocument, XmlTextReader, XmlReader.Create, XmlSerializer, and XslCompiledTransform construction in the tree with:

• XmlReaderSettings { DtdProcessing = DtdProcessing.Prohibit, XmlResolver = null }
• XmlDocument().XmlResolver = null
• XslCompiledTransform(enableDebug: false) + settings.EnableDocumentFunction = false

Add a Roslyn analyzer or repo-wide grep guard (CI-enforced) to prevent regressions.

Refs: dime cycle-1 T1 (security-audit) — commit 04f487b5.