Skip to content

Commit e575ebd

Browse files
author
Dik Takken
committed
Deprecate libxml_disable_entity_loader()
This method was used to protect code against XXE processing attacks. Since PHP now requires libxml >= 2.9.0 external entity loading no longer needs to be disabled to prevent these attacks. It is disabled by default. Also, the method has an unwanted side effect that causes a lot of confusion: Parsing XML data from resources like files is no longer possible.
1 parent a40b4ba commit e575ebd

File tree

2 files changed

+3
-1
lines changed

2 files changed

+3
-1
lines changed

ext/libxml/libxml_arginfo.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ static const zend_function_entry ext_functions[] = {
4242
ZEND_FE(libxml_get_last_error, arginfo_libxml_get_last_error)
4343
ZEND_FE(libxml_get_errors, arginfo_libxml_get_errors)
4444
ZEND_FE(libxml_clear_errors, arginfo_libxml_clear_errors)
45-
ZEND_FE(libxml_disable_entity_loader, arginfo_libxml_disable_entity_loader)
45+
ZEND_DEP_FE(libxml_disable_entity_loader, arginfo_libxml_disable_entity_loader)
4646
ZEND_FE(libxml_set_external_entity_loader, arginfo_libxml_set_external_entity_loader)
4747
ZEND_FE_END
4848
};

ext/libxml/tests/libxml_disable_entity_loader.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ echo "Done\n";
3333
?>
3434
--EXPECTF--
3535
bool(true)
36+
37+
Deprecated: Function libxml_disable_entity_loader() is deprecated in %s on line %d
3638
bool(false)
3739

3840
Warning: DOMDocument::loadXML(): I/O warning : failed to load external entity "%s" in %s on line %d

0 commit comments

Comments
 (0)