Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:58348
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain nebm.ist.utl.pt from 193.136.128.21 cause and error)
Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes
To: "PHP Internals List" <internals@lists.php.net>, "Simon Schick"
 <simonsimcity@googlemail.com>
References: <CAJWj5+F5Dxi4yQrTuqyM7AVUkA2fbzEtx5JDzENV+i2XyT9NRg@mail.gmail.com>
Date: Wed, 29 Feb 2012 21:52:07 +0100
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Organization: =?utf-8?Q?N=C3=BAcleo_de_Eng=2E_Biom=C3=A9di?=
 =?utf-8?Q?ca_do_I=2ES=2ET=2E?=
Message-ID: <op.wagj85rfidpuyk@damnation.mshome.net>
In-Reply-To: <CAJWj5+F5Dxi4yQrTuqyM7AVUkA2fbzEtx5JDzENV+i2XyT9NRg@mail.gmail.com>
User-Agent: Opera Mail/11.61 (Win32)
Subject: Re: [PHP-DEV] Vulnerability by loading doctype-declaration of xml
From: glopes@nebm.ist.utl.pt ("Gustavo Lopes")

On Wed, 29 Feb 2012 19:30:15 +0100, Simon Schick  
<simonsimcity@googlemail.com> wrote:

> I just read this post about a vulnerability by loading  
> doctype-declaration
> of an xml-string given in a request:
> http://www.idontplaydarts.com/2011/02/scanning-the-internal-network-using-simplexml/
>
> Would it be a good point to restrict which urls can be loaded in the
> doctype, or is the following line the only possibility to prevent it in a
> good way?
> libxml_disable_entity_loader(true);
>

In PHP 5.4, you can use libxml_set_external_entity_loader() and define  
your own logic. I'm afraid it's not documented yet, but it receives a  
callback that takes two strings, a public id and system id and a context  
(an array with four keys). The callback should return a resource, a string  
 from which a resource can be opened, or NULL.

-- 
Gustavo Lopes