Take care of External XML Entities

[attilammagyar]

Should be able to work with XML files from untrusted sources without letting XXE injection attacks through.

• https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
• http://www.php.net/manual/en/wrappers.php

Example:

<?xml version="1.0" encoding="ISO-8859-1"?>
 <!DOCTYPE foo [  
   <!ELEMENT foo ANY >
   <!ENTITY xxe SYSTEM 'php://filter/read=convert.base64-encode/resource=/etc/passwd'>]>
   <foo>&xxe;</foo>