fixed XML decoding attack vector through external entities

symfony · Aug 28, 2012 · 178b3eb · 178b3eb
1 parent cb3439f
commit 178b3eb
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/Loader/XliffFileLoader.php b/Loader/XliffFileLoader.php
@@ -56,14 +56,19 @@ public function load($resource, $locale, $domain = 'messages')
     private function parseFile($file)
     {
         $internalErrors = libxml_use_internal_errors(true);
+        $disableEntities = libxml_disable_entity_loader(true);
         libxml_clear_errors();
 
         $dom = new \DOMDocument();
         $dom->validateOnParse = true;
-        if (!@$dom->load($file, LIBXML_NONET | (defined('LIBXML_COMPACT') ? LIBXML_COMPACT : 0))) {
+        if (!@$dom->loadXML(file_get_contents($file), LIBXML_NONET | (defined('LIBXML_COMPACT') ? LIBXML_COMPACT : 0))) {
+            libxml_disable_entity_loader($disableEntities);
+
             throw new \RuntimeException(implode("\n", $this->getXmlErrors($internalErrors)));
         }
 
+        libxml_disable_entity_loader($disableEntities);
+
         foreach ($dom->childNodes as $child) {
             if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
                 libxml_use_internal_errors($internalErrors);
@@ -90,6 +95,7 @@ private function parseFile($file)
         if (!@$dom->schemaValidateSource($source)) {
             throw new \RuntimeException(implode("\n", $this->getXmlErrors($internalErrors)));
         }
+
         $dom->normalizeDocument();
 
         libxml_use_internal_errors($internalErrors);