Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87415
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.182 as permitted sender)
To: Anthony Ferrara <ircmaxell@gmail.com>, Jake <php@freepanel.net>
References: <CAAyV7nES6A+_68A2eMdxAGw--_R-A7WhhQJ6VyMzi5p7PneBXw@mail.gmail.com>
 <55BA59A1.9020503@freepanel.net>
 <CAAyV7nHKseQ1hX0XhN6WDvfJR+A10HX=apcK=hMXTSijQucbMA@mail.gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <55BA7395.2090202@gmail.com>
Date: Thu, 30 Jul 2015 11:57:25 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.1.0
MIME-Version: 1.0
In-Reply-To: <CAAyV7nHKseQ1hX0XhN6WDvfJR+A10HX=apcK=hMXTSijQucbMA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Disabling External Entities in libxml By Default
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> The problem here is that imagine the following:

I think if we separate the loading the initial file (i.e., staring point
of the XML parser) and the loading the entities from that file (which is
not happening right now) we'd solve many BC problems. Not sure about
SOAP, but many others for sure.

> I know that you want it to work, but this is actually a great place to
> fail, because you're loading a trusted resource over HTTP. Meaning
> that an attacker could MITM and inject malicous XML into the response,
> and own your server without even needing to own the endpoint.

I feel like XML parser is a wrong place to solve this problem, transport
security can be done in HTTPS, signatures, etc. Otherwise many protocols
that rely on XML - such as SAML, which is quite widely used - would be
completely useless.

-- 
Stas Malyshev
smalyshev@gmail.com