[doc-en] master: `DOMDocument::xinclude()`: Add a warning about untrusted input (#5862)

Author: Daniel Scherzer (DanielEScherzer) Committer: GitHub (web-flow) Pusher: DanielEScherzer Date: 2026-09-17T18:14:02-07:00 Commit: https://github.com/php/doc-en/commit/a8093165f0158ce673d98310e0874eeea4c9de68 Raw diff: https://github.com/php/doc-en/commit/a8093165f0158ce673d98310e0874eeea4c9de68.diff DOMDocument::xinclude(): Add a warning about untrusted input (#5862) Changed paths: M reference/dom/domdocument/xinclude.xml Diff: diff --git a/reference/dom/domdocument/xinclude.xml b/reference/dom/domdocument/xinclude.xml index 0528a4f32bcd..00ff50d52a93 100644 --- a/reference/dom/domdocument/xinclude.xml +++ b/reference/dom/domdocument/xinclude.xml @@ -22,6 +22,14 @@ unexpected results if the included XML file have an attached DTD. </para> </note> + <warning> + <simpara> + Avoid calling this method on untrusted XML, as XIncludes can include + files from external websites (when the <literal>href</literal> attribute + is a URL) or arbitrary local files (when the <literal>href</literal> + attribute uses <literal>file://</literal>). + </simpara> + </warning> </refsect1> <refsect1 role="parameters"> &reftitle.parameters;