Doc #62577 [Opn->Csd]: simplexml_load_file does not file if libxml_disable_entity_loader(true)

Edit report at https://bugs.php.net/bug.php?id=62577&edit=1 ID: 62577 Updated by: phpdocbot@php.net Reported by: ivan dot enderlin at hoa-project dot net Summary: simplexml_load_file does not file if libxml_disable_entity_loader(true) -Status: Open +Status: Closed Type: Documentation Problem Package: *XML functions Operating System: All PHP Version: master-Git-2012-07-16 (Git) Block user comment: N Private report: N New Comment: Automatic comment on behalf of cmb Revision: http://git.php.net/?p=doc/en.git;a=commit;h=a07808fdd74a7ebda792e77c4c7b377e6d44f26a Log: Fix #62577: simplexml_load_file does not file if libxml_disable_entity_loader(true) Previous Comments: ------------------------------------------------------------------------ [2020-08-31 16:09:27] cmb@php.net Like Hans Krentel already said; the fix is simple: just don't call libxml_disable_entity_loader(), because as of libxml >= 2.9.0 entity reference substitution is disabled by default. If you're still using libxml < 2.9.0, better change that. libxml_disable_entity_loader() is deprecated as of PHP 8.0.0. I'm changing this to documentation problem. ------------------------------------------------------------------------ [2020-08-31 16:00:08] cmb@php.net Related To: Bug #69910 ------------------------------------------------------------------------ [2018-12-23 21:15:41] hanskrentel at yahoo dot de Most likely this is not a bug. Those who disable the entity loader via libxml_disable_entity_loader() are dealing with an underlying problem with an unpatched libxml version. Those who not have forgotten to implement their own entity loader (which is possible) which does not prevent from loading. Same for the default entity loader being enabled. Just my 2 cents. ------------------------------------------------------------------------ [2018-10-18 21:23:30] gudang at gmail dot com 6 years... ------------------------------------------------------------------------ [2018-10-15 10:50:03] cmb@php.net Hmm, I wonder why we check whether external entity loading is disabled in php_libxml_input_buffer_create_filename()[1] (which is the xmlParserInputBufferCreateFilenameDefault() callback), instead of in _php_libxml_external_entity_loader()[2] (which is the xmlSetExternalEntityLoader() callback). (See the attached move-entity_loader_disabled-check patch.) Wouldn't the latter be sufficient to prevent XXE attacks? Also I wonder whether we need libxml_disable_entity_loader() at all. Only if LIBXML_DTDLOAD|LIBXML_NOENT are given as options, external entities will be resolved. Some of the XML parsers don't accept options, but at least as of libxml 2.9.0 save defaults are used anyway[3]. [1] <https://github.com/php/php-src/blob/php-7.3.0RC3/ext/libxml/libxml.c#L395> [2] <https://github.com/php/php-src/blob/php-7.3.0RC3/ext/libxml/libxml.c#L572> [3] <https://gitlab.gnome.org/GNOME/libxml2/commit/4629ee02ac649c27f9c0cf98ba017c6b5526070f> ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=62577 -- Edit this bug report at https://bugs.php.net/bug.php?id=62577&edit=1