Edit Report a Bug

libxml_disable_entity_loader

(PHP 5 >= 5.2.11)

libxml_disable_entity_loader — Deshabilita la capacidad de cargar entidades externas

Descripción

bool libxml_disable_entity_loader ([ bool $disable = true ] )

Habilita/deshabilita la capacidad de cargar entidades externas.

Parámetros

disable: Deshabilita (TRUE) o habilita (FALSE) extensiones libxml (tal como DOM, XMLWriter y XMLReader) para cargar entidades externas.

Valores devueltos

Devuelve el valor anterior.

Ver también

libxml_use_internal_errors() - Deshabilita errores libxml y permite al usuario extraer información de errores según sea necesario
La constante LIBXML_NONET

add a note

User Contributed Notes 4 notes

down

simonsimcity ¶

2 years ago


Using this function you can prevent a vulnerable to Local and Remote File Inclusion attacks.

You'll see it in an example where I load and validate the following string:

<!DOCTYPE scan [<!ENTITY test SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">]>
<scan>&test;</scan>

One way to prevent that the file in given back is to set this value to 0.
Please take a closer look at the release of symfony 2.0.11

down

daschtour at me dot com ¶

7 months ago


This function was reported to be not thread safe. So this might affect php-scripts on the same server.

down

brendan at bloodbone dot ws ¶

4 months ago


This also seems to have an impact on <xsl:import /> statements if this is applied when loading XSLT for the XSLTProcessor class.

down

phofstetter at sensational dot ch ¶

6 months ago


Be mindful that this also disables url loading in simplexml_load_file() and likely other libxml based functions that deal with URLs

add a note