mirror of
https://github.com/php/php-src.git
synced 2025-08-16 05:58:45 +02:00
f0441e05b8
This constant is available as of libxml2 2.13, and is used together with LIBXML_NOENT to allow entity subsitution but disallow external entities.
29 lines
612 B
PHP
29 lines
612 B
PHP
--TEST--
|
|
Test flag LIBXML_NO_XXE
|
|
--EXTENSIONS--
|
|
dom
|
|
--SKIPIF--
|
|
<?php
|
|
if (!defined('LIBXML_NO_XXE')) die('skip LIBXML_NO_XXE not available');
|
|
?>
|
|
--FILE--
|
|
<?php
|
|
$xml = <<< XML
|
|
<?xml version='1.0' encoding='utf-8'?>
|
|
<!DOCTYPE set [
|
|
<!ENTITY foo '<foo>bar</foo>'>
|
|
<!ENTITY xxe SYSTEM "file:///etc/passwd">
|
|
]>
|
|
<set>&foo;&xxe;</set>
|
|
XML;
|
|
|
|
$doc = Dom\XMLDocument::createFromString($xml, LIBXML_NOENT | LIBXML_NO_XXE);
|
|
echo $doc->saveXML();
|
|
?>
|
|
--EXPECT--
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<!DOCTYPE set [
|
|
<!ENTITY foo "<foo>bar</foo>">
|
|
<!ENTITY xxe SYSTEM "file:///etc/passwd">
|
|
]>
|
|
<set><foo>bar</foo></set>
|