Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87416
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.180 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <55BA7395.2090202@gmail.com>
References: <CAAyV7nES6A+_68A2eMdxAGw--_R-A7WhhQJ6VyMzi5p7PneBXw@mail.gmail.com>
	<55BA59A1.9020503@freepanel.net>
	<CAAyV7nHKseQ1hX0XhN6WDvfJR+A10HX=apcK=hMXTSijQucbMA@mail.gmail.com>
	<55BA7395.2090202@gmail.com>
Date: Thu, 30 Jul 2015 15:32:42 -0400
Message-ID: <CAAyV7nHvt2rCBwj=HKZw5gBS6a3u==EKMEL5S8iRgG4je4-zQw@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Jake <php@freepanel.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Disabling External Entities in libxml By Default
From: ircmaxell@gmail.com (Anthony Ferrara)

Stas,

On Thu, Jul 30, 2015 at 2:57 PM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
> Hi!
>
>> The problem here is that imagine the following:
>
> I think if we separate the loading the initial file (i.e., staring point
> of the XML parser) and the loading the entities from that file (which is
> not happening right now) we'd solve many BC problems. Not sure about
> SOAP, but many others for sure.

Yeah, that seems reasonable. I'll take a peek at the code to see how
bad it will be to separate it (though I'm not familiar with the xml
extensions much).

>> I know that you want it to work, but this is actually a great place to
>> fail, because you're loading a trusted resource over HTTP. Meaning
>> that an attacker could MITM and inject malicous XML into the response,
>> and own your server without even needing to own the endpoint.
>
> I feel like XML parser is a wrong place to solve this problem, transport
> security can be done in HTTPS, signatures, etc. Otherwise many protocols
> that rely on XML - such as SAML, which is quite widely used - would be
> completely useless.

Yeah, it's a pretty complex problem. I think there should likely be
multiple levels of defense. One level is limiting external entity
requests by default. Another level would be potentially to add a
context option to dom document to allow you to whitelist URLs or
servers.

I think the point would be to document and make it secure by-default,
but provide the ability to turn it back on if you know what you're
doing (though that potentially has a bunch of possible problems as
well).

Anthony