Req #81210 [Opn->Fbk]: Disable XML External Entities by config

Edit report at https://bugs.php.net/bug.php?id=81210&edit=1 ID: 81210 Updated by: cmb@php.net Reported by: mail at 12live dot de Summary: Disable XML External Entities by config -Status: Open +Status: Feedback Type: Feature/Change Request Package: PHP options/info functions PHP Version: Irrelevant -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: As of libxml2 2.9.0, substitution of external entities is disabled by default. You need to explicitly pass XML_NOENT to the respective functions to enable it. Are you suggesting that an ini setting should make XML_NOENT to have no effect? Previous Comments: ------------------------------------------------------------------------ [2021-06-30 11:40:24] mail at 12live dot de Can´t agree on that. Of course your code should be secure but the ini option could be another element regarding "Defense in depth". PHP already has such switches. Also if i completely run php on my own controlled environment this would help harden the environment. Especially regarding libraries beeing used where it is not always obvious that there might be a XML Ecternal Entity sink ------------------------------------------------------------------------ [2021-06-30 11:34:14] rtrtrtrtrt at dfdfdfdf dot dfd such switches are a terrible idea because you can't know where your code will run in the future - instead write good code you rely on luck of a server config which could change tomorrow ------------------------------------------------------------------------ [2021-06-30 11:29:11] mail at 12live dot de Description: ------------ As XML External Entity is still a serious security risk, i would like to have the ini option to disable this globally PHP level. Ideally it would be disabled by default (as GO does) but I can understand if this is not feasible. At least not if PHP claims to be XML standard compliant by default. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81210&edit=1