Bug->Doc #62577 [Opn]: simplexml_load_file does not file if libxml_disable_entity_loader(true)

Edit report at https://bugs.php.net/bug.php?id=62577&edit=1 ID: 62577 Updated by: cmb@php.net Reported by: ivan dot enderlin at hoa-project dot net Summary: simplexml_load_file does not file if libxml_disable_entity_loader(true) Status: Open -Type: Bug +Type: Documentation Problem -Package: SimpleXML related +Package: *XML functions Operating System: All PHP Version: master-Git-2012-07-16 (Git) Block user comment: N Private report: N New Comment: Like Hans Krentel already said; the fix is simple: just don't call libxml_disable_entity_loader(), because as of libxml >= 2.9.0 entity reference substitution is disabled by default. If you're still using libxml < 2.9.0, better change that. libxml_disable_entity_loader() is deprecated as of PHP 8.0.0. I'm changing this to documentation problem. Previous Comments: ------------------------------------------------------------------------ [2020-08-31 16:00:08] cmb@php.net Related To: Bug #69910 ------------------------------------------------------------------------ [2018-12-23 21:15:41] hanskrentel at yahoo dot de Most likely this is not a bug. Those who disable the entity loader via libxml_disable_entity_loader() are dealing with an underlying problem with an unpatched libxml version. Those who not have forgotten to implement their own entity loader (which is possible) which does not prevent from loading. Same for the default entity loader being enabled. Just my 2 cents. ------------------------------------------------------------------------ [2018-10-18 21:23:30] gudang at gmail dot com 6 years... ------------------------------------------------------------------------ [2018-10-15 10:50:03] cmb@php.net Hmm, I wonder why we check whether external entity loading is disabled in php_libxml_input_buffer_create_filename()[1] (which is the xmlParserInputBufferCreateFilenameDefault() callback), instead of in _php_libxml_external_entity_loader()[2] (which is the xmlSetExternalEntityLoader() callback). (See the attached move-entity_loader_disabled-check patch.) Wouldn't the latter be sufficient to prevent XXE attacks? Also I wonder whether we need libxml_disable_entity_loader() at all. Only if LIBXML_DTDLOAD|LIBXML_NOENT are given as options, external entities will be resolved. Some of the XML parsers don't accept options, but at least as of libxml 2.9.0 save defaults are used anyway[3]. [1] <https://github.com/php/php-src/blob/php-7.3.0RC3/ext/libxml/libxml.c#L395> [2] <https://github.com/php/php-src/blob/php-7.3.0RC3/ext/libxml/libxml.c#L572> [3] <https://gitlab.gnome.org/GNOME/libxml2/commit/4629ee02ac649c27f9c0cf98ba017c6b5526070f> ------------------------------------------------------------------------ [2018-10-15 10:50:01] cmb@php.net The following patch has been added/updated: Patch Name: move-entity_loader_disabled-check Revision: 1539600601 URL: https://bugs.php.net/patch-display.php?bug=62577&patch=move-entity_loader_disabled-check&revision=1539600601 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=62577 -- Edit this bug report at https://bugs.php.net/bug.php?id=62577&edit=1