Bug #62577 [Com]: simplexml_load_file does not file if libxml_disable_entity_loader(true)

Edit report at https://bugs.php.net/bug.php?id=62577&edit=1 ID: 62577 Comment by: phofstetter at sensational dot ch Reported by: ivan dot enderlin at hoa-project dot net Summary: simplexml_load_file does not file if libxml_disable_entity_loader(true) Status: Assigned Type: Bug Package: SimpleXML related Operating System: All PHP Version: master-Git-2012-07-16 (Git) Assigned To: rrichards Block user comment: N Private report: N New Comment: External entity loading in XML is problematic security-wise (see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing and for example http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution where Facebook was hit by that). It's generally advised to turn off external entity loading. But because of this bug, turning that off also turns off *all* external file loading via libxml. What we need IMHO is something that turns off loading files in response to parsing untrusted XML. Requesting XML from an external source in itself isn't a problem. If this current behaviour is intended, please consider adding a note to the documentation explaining the case and telling users to use fopen (though that means that it's no longer possible to work with a huge stream of XML data because libxml_disable_entity_loader() also disables XmlReader::open() Previous Comments: ------------------------------------------------------------------------ [2013-12-15 01:19:07] claudio dot mulas at lucla dot net Finally i've found what's the problem on my website. Still not fixed? :( ------------------------------------------------------------------------ [2013-08-29 07:18:51] ivan dot enderlin at hoa-project dot net ping? Any news from the front? ------------------------------------------------------------------------ [2013-05-29 07:21:46] sjon at hortensius dot net I can confirm this issue; it is very annoying and unexpected. Can't the code, as a work-around use file-get-contents + simplexml_load_string internally? This issue is also related to bug #64938 imo ------------------------------------------------------------------------ [2013-05-29 07:20:39] Sjon at hortensius dot net I can confirm this issue; it is very annoying and unexpected. Can't the code, as a work-around use file-get-contents + simplexml_load_string internally? This issue is also related to #22215 imo ------------------------------------------------------------------------ [2012-11-15 11:03:10] pajoye@php.net hi Rob! What would be the best/cleanest fix for this issue? It affects quite a lot of apps out there. Thanks! ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=62577 -- Edit this bug report at https://bugs.php.net/bug.php?id=62577&edit=1