mirror of
https://github.com/php/php-src.git
synced 2025-08-15 21:48:51 +02:00
f0441e05b8
This constant is available as of libxml2 2.13, and is used together with LIBXML_NOENT to allow entity subsitution but disallow external entities.
28 lines
513 B
PHP
28 lines
513 B
PHP
--TEST--
|
|
XML parsing with LIBXML_NO_XXE
|
|
--EXTENSIONS--
|
|
simplexml
|
|
--SKIPIF--
|
|
<?php
|
|
if (!defined('LIBXML_NO_XXE')) die('skip LIBXML_NO_XXE not available');
|
|
?>
|
|
--FILE--
|
|
<?php
|
|
|
|
$xml = <<< XML
|
|
<?xml version='1.0' encoding='utf-8'?>
|
|
<!DOCTYPE set [
|
|
<!ENTITY foo '<foo>bar</foo>'>
|
|
<!ENTITY xxe SYSTEM "file:///etc/passwd">
|
|
]>
|
|
<set>&foo;&xxe;</set>
|
|
XML;
|
|
|
|
var_dump(simplexml_load_string($xml, options: LIBXML_NOENT | LIBXML_NO_XXE));
|
|
|
|
?>
|
|
--EXPECT--
|
|
object(SimpleXMLElement)#1 (1) {
|
|
["foo"]=>
|
|
string(3) "bar"
|
|
}
|