@@ -59,35 +59,43 @@ public override Message ReadMessage(ArraySegment<byte> buffer, BufferManager buf
5959
6060 public override Message ReadMessage ( Stream stream , int maxSizeOfHeaders , string contentType )
6161 {
62- var sr = new StreamReader ( stream ) ;
63- var wireResponse = sr . ReadToEnd ( ) ;
64- sr . Close ( ) ;
62+ String wireResponse ;
6563
64+ using ( var sr = new StreamReader ( stream ) )
65+ {
66+ wireResponse = sr . ReadToEnd ( ) ;
67+ }
68+
6669 // Fix for Xml external entity injection violation in fortify report
6770 XmlReaderSettings settings = new XmlReaderSettings ( ) ;
6871 settings . DtdProcessing = DtdProcessing . Prohibit ;
6972 settings . XmlResolver = null ;
7073
7174 XmlDocument doc = new XmlDocument ( ) ;
72- StringReader stringReader = new StringReader ( wireResponse ) ;
73- XmlReader reader = XmlReader . Create ( stringReader , settings ) ;
74- doc . Load ( reader ) ;
75- //We need to get rid of the security header because it is not signed by the web service.
76- //The whole reason for the custom Encoder is to do this. the client rejected the unsigned header.
77- //Our WCF client is set up to allow the absence of a security header but if the header exists then it must be signed.
78- //Hopefully the namespace will not change. Maybe it should be put in a config.
79- XPathNavigator n = doc . CreateNavigator ( ) ;
80- if ( n . MoveToFollowing ( "Security" , "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" ) )
75+ Message returnMessage = null ;
76+
77+ using ( StringReader stringReader = new StringReader ( wireResponse ) )
8178 {
82- n . DeleteSelf ( ) ;
79+ using ( XmlReader reader = XmlReader . Create ( stringReader , settings ) )
80+ {
81+ doc . Load ( reader ) ;
82+
83+ //We need to get rid of the security header because it is not signed by the web service.
84+ //The whole reason for the custom Encoder is to do this. the client rejected the unsigned header.
85+ //Our WCF client is set up to allow the absence of a security header but if the header exists then it must be signed.
86+ //Hopefully the namespace will not change. Maybe it should be put in a config.
87+
88+ XPathNavigator n = doc . CreateNavigator ( ) ;
89+ if ( n . MoveToFollowing ( "Security" , "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" ) )
90+ {
91+ n . DeleteSelf ( ) ;
92+ }
93+
94+ StringReader stringReaderInnerXml = new StringReader ( doc . InnerXml ) ;
95+ XmlReader reader2 = XmlReader . Create ( stringReaderInnerXml , settings ) ;
96+ returnMessage = Message . CreateMessage ( reader2 , maxSizeOfHeaders , MessageVersion . Soap11 ) ;
97+ }
8398 }
84- StringReader stringReaderInnerXml = new StringReader ( doc . InnerXml ) ;
85- reader = XmlReader . Create ( stringReaderInnerXml , settings ) ;
86- Message returnMessage = Message . CreateMessage ( reader , maxSizeOfHeaders , MessageVersion . Soap11 ) ;
87-
88- stringReader . Close ( ) ;
89- stringReaderInnerXml . Close ( ) ;
90- reader . Close ( ) ;
9199
92100 return returnMessage ;
93101 }
0 commit comments