Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87376
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.15.18 as permitted sender)
Message-ID: <55B94D0B.40908@gmx.de>
Date: Thu, 30 Jul 2015 00:00:43 +0200
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: Anthony Ferrara <ircmaxell@gmail.com>, 
 "internals@lists.php.net" <internals@lists.php.net>
References: <CAAyV7nES6A+_68A2eMdxAGw--_R-A7WhhQJ6VyMzi5p7PneBXw@mail.gmail.com>
In-Reply-To: <CAAyV7nES6A+_68A2eMdxAGw--_R-A7WhhQJ6VyMzi5p7PneBXw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: Disabling External Entities in libxml By Default
From: cmbecker69@gmx.de (Christoph Becker)

Anthony Ferrara wrote:

> I wanted to float an idea by you for PHP 7 (or 7.1 depending on the
> RM's feedback).
> 
> Currently, PHP by default is vulnerable to XXE attacks:
> https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing
> 
> To bypass this, you need to turn off external entity loading:
> 
> libxml_disable_entity_loader(true);
> 
> What I'm proposing is to disable entity loading by default. That way
> it requires developers to opt-in to actually load external entities.
> 
> Thoughts?

A problem is reported as bug #62577.  As it is now, when
libxml_disable_entity_loader(true) has been called, no XML file can be
loaded, i.e. simplexml_load_file(), DOMDocument::load() etc. always
fails, even if the XML doesn't contain any entities at all.

-- 
Christoph M. Becker