Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87375
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain belski.net from 85.214.73.107 cause and error)
To: "'Pierre Joye'" <pierre.php@gmail.com>,
	"'Anthony Ferrara'" <ircmaxell@gmail.com>
Cc: "'PHP internals'" <internals@lists.php.net>
References: <CAAyV7nES6A+_68A2eMdxAGw--_R-A7WhhQJ6VyMzi5p7PneBXw@mail.gmail.com> <CAEZPtU7HAne7mvkxUqo2yBV6_FRAibUnjqRiDVL99QRdna=-OQ@mail.gmail.com>
In-Reply-To: <CAEZPtU7HAne7mvkxUqo2yBV6_FRAibUnjqRiDVL99QRdna=-OQ@mail.gmail.com>
Date: Wed, 29 Jul 2015 23:18:36 +0200
Message-ID: <017601d0ca44$2436c360$6ca44a20$@belski.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Thread-Index: AQG+TCeSKEAF7uPyqKJ8EqW/NivELQGRufB4ngtgM2A=
Content-Language: en-us
Subject: RE: [PHP-DEV] Disabling External Entities in libxml By Default
From: anatol.php@belski.net ("Anatol Belski")

Hi,

> -----Original Message-----
> From: Pierre Joye [mailto:pierre.php@gmail.com]
> Sent: Wednesday, July 29, 2015 11:01 PM
> To: Anthony Ferrara <ircmaxell@gmail.com>
> Cc: PHP internals <internals@lists.php.net>
> Subject: Re: [PHP-DEV] Disabling External Entities in libxml By =
Default
>=20
> On Jul 29, 2015 11:38 PM, "Anthony Ferrara" <ircmaxell@gmail.com> =
wrote:
> >
> > All,
> >
> > I wanted to float an idea by you for PHP 7 (or 7.1 depending on the
> > RM's feedback).
> >
> > Currently, PHP by default is vulnerable to XXE attacks:
> > https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
> >
> > To bypass this, you need to turn off external entity loading:
> >
> > libxml_disable_entity_loader(true);
> >
> > What I'm proposing is to disable entity loading by default. That way
> > it requires developers to opt-in to actually load external entities.
> >
> > Thoughts?
>=20
> I am for it, for 7.0 or 8.0.
>=20
> We discussed it during the last related flaw and decided not to do it =
for BC
> reasons (whatever it means in this case).
>=20
> This problem went off our radar, so yes, we should do it in 7.0. =
Changing default
> in minor versions always create more troubles.
>=20
To note were that the libxml-2.9.2 in Windows builds already contains =
patches mentioned in https://www.debian.org/security/2013/dsa-2652 , see =
https://github.com/winlibs/libxml2/commit/727e357fb21b95d5c315518bdac99a7=
0a6d15ff8 ... Most of the distributions should already have these =
patches. Probably we should check whether disabling it in PHP were =
unnecessary, but if it's not - ofc 7.0 should be the target at least.

Regards

Anatol