Reduce EncryptedXml encoded DTD test workload

[eiriktsarpalis]

The encoded-DTD payload contains 111 transforms, including 100 repeated canonicalization transforms. Tests that execute the chain can consume a full CPU until the 60-second timeout.

Remove 90 redundant canonicalization transforms so the payload contains 21 transforms, exactly one above the default limit of 20. This preserves the transform-limit boundary while reducing the release-style workload to roughly 13 seconds. The test now asserts the exact boundary to prevent the payload from growing accidentally.

Fixes #130929

cc @mrek-msft

Note

This pull request was created by GitHub Copilot.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Reduces CPU-heavy workload in the EncryptedXml encoded-DTD test payload by shrinking the embedded transform chain while keeping the test positioned just over the default “max transforms per chain” boundary.

Changes:

• Tighten EncryptedXml_DecryptedEncodedDtd to assert an exact transform-count boundary (default + 1) rather than “> 20”.
• Remove a large set of redundant canonicalization transforms from EncryptedXmlSample5.xml to reduce runtime cost while preserving the boundary scenario.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/libraries/System.Security.Cryptography.Xml/tests/EncryptedXmlTests.cs	Adds a default-limit constant and asserts the encoded DTD payload sits exactly at DefaultMaxTransformsPerChain + 1.
src/libraries/System.Security.Cryptography.Xml/tests/EncryptedXmlSample5.xml	Removes many repeated c14n transforms to substantially reduce the transform chain length/workload.

[github-actions]

Workflow state for the Holistic Review Orchestrator.

{
  "version": 5,
  "last_dispatched_commit": "280efbfcb115f36488ec394f1fc8c480fa1e484d",
  "last_dispatched_base_ref": "main",
  "last_dispatched_base_sha": "840cea322a2978a568e8cdfd4d2e643fcf42aa1c",
  "last_reviewed_commit": "280efbfcb115f36488ec394f1fc8c480fa1e484d",
  "last_reviewed_base_ref": "main",
  "last_reviewed_base_sha": "840cea322a2978a568e8cdfd4d2e643fcf42aa1c",
  "last_recorded_worker_run_id": "29761355815",
  "review_attempt_commit": "",
  "review_attempt_base_ref": "",
  "review_attempt_count": 0,
  "max_review_attempts": 5,
  "review_history_format": "holistic-review-disclosure-v1",
  "review_history": [
    {
      "commit": "280efbfcb115f36488ec394f1fc8c480fa1e484d",
      "review_id": 4737147556
    }
  ]
}

[github-actions]

Holistic Review

Motivation: The EncryptedXmlSample5.xml test payload used to reproduce the DTD transform-chain limit contained 111 transforms, 100 of which were repeated xml-c14n canonicalization transforms. Tests that execute the chain (in Release/RemoteExecutor configurations) burned a full CPU for ~13s and could approach the 60s test timeout, contributing to issue #130929.

Approach: Removes 90 redundant xml-c14n transforms from EncryptedXmlSample5.xml, leaving 21 transforms—exactly one above the default MaxTransformsPerChain limit of 20. The C# test is tightened from Assert.True(count > 20) to Assert.Equal(DefaultMaxTransformsPerChain + 1, count) (with a new named constant), so the payload boundary is pinned and cannot silently grow again.

Summary: This is a well-scoped, test-only change. I verified the resulting payload contains exactly 21 ds:Transform elements, matching the new exact assertion (DefaultMaxTransformsPerChain + 1 == 21). The boundary semantics are preserved: the payload still exceeds the default limit so DecryptDocument/LoadXml still throws the expected CryptographicException with "Malformed element Transforms.". The EncodedDtdTransformChainLimits MemberData still derives its {20,true}/{21,false} cases from GetEncodedDtdPayloadTransformCount(), so the exact-limit and unlimited RemoteExecutor tests continue to exercise the just-below / at / unlimited boundaries correctly against the smaller payload. No product code changes; naming and comments follow repo conventions. No issues found.

Verdict: LGTM.

Note

This review was generated by this repository's Holistic Review agentic workflow to complement the built-in Copilot review.

Generated by Holistic Review · 51.2 AIC · ⌖ 14.3 AIC · ⊞ 10K