CODEWITHSUNDEEP
phpxmlexternaldtdentities
user619
user619

Reputation: 119

External Entities in DTD with SYSTEM are not resolved in PHP

I can't figure out the following issue. I want to resolve an external entity in a DTD based on SYSTEM: I run on the latest Ubuntu 12.10.. no custom changes!

I have the following PHP test code: 

<h1>simpleXml Demo</h1>
<form name="input" action="" method="POST">
  <textarea  name="xmlInput"></textarea><br />
  <input type="submit" value="Submit">
</form> 
<?php
if(isset($_POST['xmlInput']) and strlen($_POST['xmlInput'])>0){
    $doc = simplexml_load_string($_POST['xmlInput']);
    echo "<pre>";
    print_r($doc);
    echo "</pre>";       
?>

Example 1: When running this XML file, the entity &foo; is resolved. 

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE results [
  <!ENTITY test "some text,">
]>
<results>
  <result>This result is &test;</result>
</results>

Example 2: When running this XML file, the entity &foo; is just replaced by nothing - no errors at all!

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE result [
  <!ENTITY test SYSTEM "http://textfiles.com/food/btaco.txt">
]>
<results>
  <result>This result is &test;</result>
</results>

I already played with 'libxml_disable_entity_loader()', it didn't change anything!

Upvotes: 1

Views: 476

Answers (1)

Dave Ferguson
Dave Ferguson

Reputation: 11

Try using the LIBXML_NOENT option at the time you parse the XML data. It is counter-intuitive, but this will enable external entities and the request to the URL will occur.

Upvotes: 1

Related Questions