Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87373
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain paragonie.com from 209.85.220.171 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAAyV7nES6A+_68A2eMdxAGw--_R-A7WhhQJ6VyMzi5p7PneBXw@mail.gmail.com>
References: <CAAyV7nES6A+_68A2eMdxAGw--_R-A7WhhQJ6VyMzi5p7PneBXw@mail.gmail.com>
Date: Wed, 29 Jul 2015 16:51:23 -0400
Message-ID: <CAKws9z12Tpubu0dbxrNCT-FM=9qJN09DdXAUP97ii1xrtCgm-A@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Disabling External Entities in libxml By Default
From: scott@paragonie.com (Scott Arciszewski)

On Wed, Jul 29, 2015 at 4:37 PM, Anthony Ferrara <ircmaxell@gmail.com> wrote:
> All,
>
> I wanted to float an idea by you for PHP 7 (or 7.1 depending on the
> RM's feedback).
>
> Currently, PHP by default is vulnerable to XXE attacks:
> https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
>
> To bypass this, you need to turn off external entity loading:
>
> libxml_disable_entity_loader(true);
>
> What I'm proposing is to disable entity loading by default. That way
> it requires developers to opt-in to actually load external entities.
>
> Thoughts?
>
> Anthony
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>

Enormous +1 to this from me. This should definitely be off by default.

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>