Preventing XEE attacks by temporarily disabling entity loader for the…

… time parsing external XML.
alpex29 · Sep 13, 2013 · 2be864c · 2be864c
1 parent 1a30b09
commit 2be864c
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/Slim/Middleware/ContentTypes.php b/Slim/Middleware/ContentTypes.php
@@ -137,7 +137,10 @@ protected function parseXml($input)
     {
         if (class_exists('SimpleXMLElement')) {
             try {
-                return new \SimpleXMLElement($input);
+                $backup = libxml_disable_entity_loader(true);
+                $result = new \SimpleXMLElement($input);
+                libxml_disable_entity_loader($backup);
+                return $result;
             } catch (\Exception $e) {
                 // Do nothing
             }