# Vulnerability by loading doctype-declaration of xml

- Thread: https://externals.io/message/58341
- Original archive: https://news-web.php.net/php.internals/58341
- Started by Simon Schick on 2012-02-29T18:30:15+00:00
- Messages: 3
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #58341 — Simon Schick — 2012-02-29T18:30:15+00:00

URL: https://externals.io/message/58341#58341

Hi, all

I just read this post about a vulnerability by loading doctype-declaration
of an xml-string given in a request:
http://www.idontplaydarts.com/2011/02/scanning-the-internal-network-using-simplexml/

Would it be a good point to restrict which urls can be loaded in the
doctype, or is the following line the only possibility to prevent it in a
good way?
libxml_disable_entity_loader(true);

Bye
Simon

---

## #58348 — Gustavo Lopes — 2012-02-29T20:52:07+00:00

URL: https://externals.io/message/58341#58348 · In reply to: #58341

On Wed, 29 Feb 2012 19:30:15 +0100, Simon Schick  
<simonsimcity@googlemail.com> wrote:

> I just read this post about a vulnerability by loading  
> doctype-declaration
> of an xml-string given in a request:
> http://www.idontplaydarts.com/2011/02/scanning-the-internal-network-using-simplexml/
>
> Would it be a good point to restrict which urls can be loaded in the
> doctype, or is the following line the only possibility to prevent it in a
> good way?
> libxml_disable_entity_loader(true);
>

In PHP 5.4, you can use `libxml_set_external_entity_loader()` and define  
your own logic. I'm afraid it's not documented yet, but it receives a  
callback that takes two strings, a public id and system id and a context  
(an array with four keys). The callback should return a resource, a string  
 from which a resource can be opened, or NULL.

-- 
Gustavo Lopes

---

## #58404 — jpauli — 2012-03-01T10:03:03+00:00

URL: https://externals.io/message/58341#58404 · In reply to: #58348

Using DOM, this can be achieved with $domDocument->resolveExternals =
false; before loading a document.

Julien.P

On Wed, Feb 29, 2012 at 9:52 PM, Gustavo Lopes <glopes@nebm.ist.utl.pt>wrote:

> On Wed, 29 Feb 2012 19:30:15 +0100, Simon Schick <
> simonsimcity@googlemail.com> wrote:
>
>  I just read this post about a vulnerability by loading doctype-declaration
> > […]
> In PHP 5.4, you can use libxml_set_external_entity_**loader() and define
> your own logic. I'm afraid it's not documented yet, but it receives a
> callback that takes two strings, a public id and system id and a context
> (an array with four keys). The callback should return a resource, a string
> from which a resource can be opened, or NULL.
>
> --
> Gustavo Lopes