XML bomb (Entity Injection) is by default taken care in .Net 4.0 but not in .Net 3.5. How? What changed?

Question 1

The default value for XmlReaderSettings.MaxCharactersFromEntities is 0 and means "no limit" as MSDN documentation says.

But there is a nasty trick not pointed out by the documentation, in .net 4 if you don't pass a XmlReaderSettings to your XmlTextReader then the limit is not set to 0 but to 10,000,000.

The relevant source code is here, even with a comment pointing out that this is a breaking change: https://referencesource.microsoft.com/#System.Xml/System/Xml/Core/XmlTextReaderImpl.cs,385

Question 2

So, you have found the culprit. In v2.0, XmlTextReaderSection.LimitCharactersFromEntities returns false so the exception is not thrown. In v4.0 XmlTextReaderSection.LimitCharactersFromEntities is omitted from the condition check so it throws the exception.

The question is what does XmlTextReaderSection.LimitCharactersFromEntities do and why does it return false? When we disassemble it, we see that it does the following:

    internal string LimitCharactersFromEntitiesString
    {
        get
        {
            return (string)base["limitCharactersFromEntities"];
        }
        set
        {
            base["limitCharactersFromEntities"] = value;
        }
    }

    private bool _LimitCharactersFromEntities
    {
        get
        {
            string limitCharactersFromEntitiesString = this.LimitCharactersFromEntitiesString;
            bool result = true;
            XmlConvert.TryToBoolean(limitCharactersFromEntitiesString, out result);
            return result;
        }
    }
    internal static bool LimitCharactersFromEntities
    {
        get
        {
            XmlTextReaderSection xmlTextReaderSection = ConfigurationManager.GetSection(XmlConfigurationString.XmlTextReaderSectionPath) as XmlTextReaderSection;
            return xmlTextReaderSection == null || xmlTextReaderSection._LimitCharactersFromEntities;
        }
    }

So internal static bool function calls private bool one. private bool calls internal string. What internal string does is it tries to get the dictionary entry "limitCharactersFromEntities" from ConfigurationSection parent class. It probably returns null, so it cannot be casted to bool (check XmlConvert.TryToBoolean source) and in the end XmlTextReaderSection.LimitCharactersFromEntities returns false.

I checked further into the source code, but I could not find how or where LimitCharactersFromEntities configuration property is initialized in v2.0 (I couldn't check the whole .NET so what I did was CTRL + F to search for that string). However I've seen that LimitCharactersFromEntities is totally omitted in v4.0 and it doesn't exist as one of configuration property names in XmlConfiguration.cs.

So I guess we can conclude that in v2.0, that's a bug.

Note: I have totally no idea about XmlDocument and the System.Xml namespace at all. I've just tried to make some educated guesses reading source code.