title: Foxpro: Is it possible to disable external entity resolution?
body: <p>Based on the documentation found here: 
  <a href="https://msdn.microsoft.com/en-us/library/we9s91f8(v=vs.71).aspx" rel="nofollow noreferrer">https://msdn.microsoft.com/en-us/library/we9s91f8(v=vs.71).aspx</a></p>
  
  <p>It appears that Microsoft Visual FoxPro is capable of conducting DTD parsing from external sources. </p>
  
  <blockquote>
    <p>"When you import XML using XMLTOCURSOR( ), Visual FoxPro uses an
    external or internal schema to determine the cursor or table
    structure. When no schema is provided, Visual FoxPro uses a "best
    guess" method to interpret XML data. This involves two passes through
    the XML, one to determine data structure and one to perform the actual
    conversion. Note that the XML, in addition to being well-formed, must
    generally conform to a format that can be interpreted as a table.
    Well-formed XML that is not easily deconstructed into a table format
    will fail to import"</p>
  </blockquote>
  
  <p>However no information is given for how one might disable the parsing of external document schemas to prevent XML external entity injections. Is it possible to disable the parsing of external schemas, or must a strategy outside the language itself be employed to prevent the vulnerability? </p>