Reintroduce libxml_disable_entity_loader() calls

[solracsf]

Long answer/description https://blog.sonarsource.com/wordpress-xxe-security-vulnerability

[kesselb]

No. But we should also check for the libxml instead of the php version like sabre-io/xml#204.

[solracsf]

@LukasReschke I found you've created #26801 some time ago about this too. Any input?

[CarlSchwan]

No. But we should also check for the libxml instead of the php version like sabre-io/xml#204.

Btw nextcloud/3rdparty#807 needs a review too :D

[CarlSchwan]

Long answer/description https://blog.sonarsource.com/wordpress-xxe-security-vulnerability

I just read the article and the vulnerability in Wordpress was not because they stopped calling libxml_disable_entity_loader in php 8 but because they added the LIBXML_NOENT flag. And with the LIBXML_NOENT and without a libxml_disable_entity_loader, there is indeed a xee vulnerability.

In Nextcloud case, we don't use the LIBXML_NOENT flag, so we should be safe. In any case, @LukasReschke should probably confirm this :)