Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87374
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.174 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAAyV7nES6A+_68A2eMdxAGw--_R-A7WhhQJ6VyMzi5p7PneBXw@mail.gmail.com>
References: <CAAyV7nES6A+_68A2eMdxAGw--_R-A7WhhQJ6VyMzi5p7PneBXw@mail.gmail.com>
Date: Thu, 30 Jul 2015 04:00:43 +0700
Message-ID: <CAEZPtU7HAne7mvkxUqo2yBV6_FRAibUnjqRiDVL99QRdna=-OQ@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1145e90657c64d051c09e1f1
Subject: Re: [PHP-DEV] Disabling External Entities in libxml By Default
From: pierre.php@gmail.com (Pierre Joye)

--001a1145e90657c64d051c09e1f1
Content-Type: text/plain; charset=UTF-8

On Jul 29, 2015 11:38 PM, "Anthony Ferrara" <ircmaxell@gmail.com> wrote:
>
> All,
>
> I wanted to float an idea by you for PHP 7 (or 7.1 depending on the
> RM's feedback).
>
> Currently, PHP by default is vulnerable to XXE attacks:
> https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
>
> To bypass this, you need to turn off external entity loading:
>
> libxml_disable_entity_loader(true);
>
> What I'm proposing is to disable entity loading by default. That way
> it requires developers to opt-in to actually load external entities.
>
> Thoughts?

I am for it, for 7.0 or 8.0.

We discussed it during the last related flaw and decided not to do it for
BC reasons (whatever it means in this case).

This problem went off our radar, so yes, we should do it in 7.0. Changing
default in minor versions always create more troubles.

Cheers,
Pierre

--001a1145e90657c64d051c09e1f1--