Zend_Xml_Security Class Reference

Static Public Member Functions
static	loadXmlErrorHandler ($errno, $errstr, $errfile, $errline)
static	scan ($xml, DOMDocument $dom=null)
static	scanFile ($file, DOMDocument $dom=null)
static	isPhpFpm ()
static	generateEntityComparison ($encoding)
static	encodeToUTF32BE ($ascii)
static	encodeToUTF32LE ($ascii)
static	encodeToUTF32odd1 ($ascii)
static	encodeToUTF32odd2 ($ascii)
static	encodeToUTF16BE ($ascii)
static	encodeToUTF16LE ($ascii)
static	encodeToUTF8 ($ascii)

Data Fields
const	ENTITY_DETECT = 'Detected use of ENTITY in XML, disabled to prevent XXE/XEE attacks'

Static Protected Member Functions
static	heuristicScan ($xml)
static	getEntityComparison ($xml)
static	detectStringEncoding ($xml)
static	detectBom ($string)
static	detectXmlStringEncoding ($xml)
static	detectXmlEncoding ($xml, $fileEncoding)
static	getBomMap ()
static	getAsciiEncodingMap ()
static	substr ($string, $start, $end)

Detailed Description

Definition at line 29 of file Security.php.

Member Function Documentation

detectBom()

static detectBom (   $string )

staticprotected

Attempt to match a known BOM.

Iterates through the return of getBomMap(), comparing the initial bytes of the provided string to the BOM of each; if a match is determined, it returns the encoding.

Parameters

string

$string

Returns

false|string Returns encoding on success.

Definition at line 223 of file Security.php.

    {
        foreach (self::getBomMap() as $criteria) {
            if (0 === strncmp($string, $criteria['bom'], $criteria['length'])) {
                return $criteria['encoding'];
            }
        }
        return false;
    }

detectStringEncoding()

static detectStringEncoding (   $xml )

staticprotected

Determine the string encoding.

Determines string encoding from either a detected BOM or a heuristic.

Parameters

string

$xml

Returns

string File encoding

Definition at line 207 of file Security.php.

    {
        $encoding = self::detectBom($xml);
        return ($encoding) ? $encoding : self::detectXmlStringEncoding($xml);
    }

detectXmlEncoding()

static detectXmlEncoding (   $xml,   $fileEncoding  )

staticprotected

Attempt to detect the specified XML encoding.

Using the file's encoding, determines if an "encoding" attribute is present and well-formed in the XML declaration; if so, it returns a list with both the ASCII representation of that declaration and the original file encoding.

If not, a list containing only the provided file encoding is returned.

Parameters

string	$xml
string	$fileEncoding

Returns

string[] Potential XML encodings

Definition at line 266 of file Security.php.

    {
        $encodingMap = self::getAsciiEncodingMap();
        $generator   = $encodingMap[$fileEncoding];
        $encAttr     = call_user_func($generator, 'encoding="');
        $quote       = call_user_func($generator, '"');
        $close       = call_user_func($generator, '>');

        $closePos    = strpos($xml, $close);
        if (false === $closePos) {
            return array($fileEncoding);
        }

        $encPos = strpos($xml, $encAttr);
        if (false === $encPos
            || $encPos > $closePos
        ) {
            return array($fileEncoding);
        }

        $encPos   += strlen($encAttr);
        $quotePos = strpos($xml, $quote, $encPos);
        if (false === $quotePos) {
            return array($fileEncoding);
        }

        $encoding = self::substr($xml, $encPos, $quotePos);
        return array(
            // Following line works because we're only supporting 8-bit safe encodings at this time.
            str_replace('\0', '', $encoding), // detected encoding
            $fileEncoding,                    // file encoding
        );
    }

detectXmlStringEncoding()

static detectXmlStringEncoding (   $xml )

staticprotected

Attempt to detect the string encoding of an XML string.

Parameters

string

$xml

Returns

string Encoding

Definition at line 239 of file Security.php.

    {
        foreach (self::getAsciiEncodingMap() as $encoding => $generator) {
            $prefix = call_user_func($generator, '<' . '?xml');
            if (0 === strncmp($xml, $prefix, strlen($prefix))) {
                return $encoding;
            }
        }

        // Fallback
        return 'UTF-8';
    }

encodeToUTF16BE()

static encodeToUTF16BE (   $ascii )

static

Encode an ASCII string to UTF-16BE

Definition at line 460 of file Security.php.

    {
        return preg_replace('/(.)/', "\0\\1", $ascii);
    }

encodeToUTF16LE()

static encodeToUTF16LE (   $ascii )

static

Encode an ASCII string to UTF-16LE

Definition at line 472 of file Security.php.

    {
        return preg_replace('/(.)/', "\\1\0", $ascii);
    }

encodeToUTF32BE()

static encodeToUTF32BE (   $ascii )

static

Encode an ASCII string to UTF-32BE

Definition at line 412 of file Security.php.

    {
        return preg_replace('/(.)/', "\0\0\0\\1", $ascii);
    }

encodeToUTF32LE()

static encodeToUTF32LE (   $ascii )

static

Encode an ASCII string to UTF-32LE

Definition at line 424 of file Security.php.

    {
        return preg_replace('/(.)/', "\\1\0\0\0", $ascii);
    }

encodeToUTF32odd1()

static encodeToUTF32odd1 (   $ascii )

static

Encode an ASCII string to UTF-32odd1

Definition at line 436 of file Security.php.

    {
        return preg_replace('/(.)/', "\0\\1\0\0", $ascii);
    }

encodeToUTF32odd2()

static encodeToUTF32odd2 (   $ascii )

static

Encode an ASCII string to UTF-32odd2

Definition at line 448 of file Security.php.

    {
        return preg_replace('/(.)/', "\0\0\\1\0", $ascii);
    }

encodeToUTF8()

static encodeToUTF8 (   $ascii )

static

Encode an ASCII string to UTF-8

Definition at line 484 of file Security.php.

    {
        return $ascii;
    }

generateEntityComparison()

static generateEntityComparison (   $encoding )

static

Generate an entity comparison based on the given encoding.

This patch is internal only, and public only so it can be used as a callable to pass to array_map.

Definition at line 398 of file Security.php.

    {
        $encodingMap = self::getAsciiEncodingMap();
        $generator   = isset($encodingMap[$encoding]) ? $encodingMap[$encoding] : $encodingMap['UTF-8'];
        return call_user_func($generator, '<!ENTITY');
    }

getAsciiEncodingMap()

static getAsciiEncodingMap ( )

staticprotected

Return a map of encoding => generator pairs.

Returns a map of encoding => generator pairs, where the generator is a callable that accepts a string and returns the appropriate byte order sequence of that string for the encoding.

Returns

array

Definition at line 354 of file Security.php.

    {
        return array(
            'UTF-32BE'   => array(__CLASS__, 'encodeToUTF32BE'),
            'UTF-32LE'   => array(__CLASS__, 'encodeToUTF32LE'),
            'UTF-32odd1' => array(__CLASS__, 'encodeToUTF32odd1'),
            'UTF-32odd2' => array(__CLASS__, 'encodeToUTF32odd2'),
            'UTF-16BE'   => array(__CLASS__, 'encodeToUTF16BE'),
            'UTF-16LE'   => array(__CLASS__, 'encodeToUTF16LE'),
            'UTF-8'      => array(__CLASS__, 'encodeToUTF8'),
            'GB-18030'   => array(__CLASS__, 'encodeToUTF8'),
        );
    }

getBomMap()

static getBomMap ( )

staticprotected

Return a list of BOM maps.

Returns a list of common encoding -> BOM maps, along with the character length to compare against.

array

Definition at line 309 of file Security.php.

    {
        return array(
            array(
                'encoding' => 'UTF-32BE',
                'bom'      => pack('CCCC', 0x00, 0x00, 0xfe, 0xff),
                'length'   => 4,
            ),
            array(
                'encoding' => 'UTF-32LE',
                'bom'      => pack('CCCC', 0xff, 0xfe, 0x00, 0x00),
                'length'   => 4,
            ),
            array(
                'encoding' => 'GB-18030',
                'bom'      => pack('CCCC', 0x84, 0x31, 0x95, 0x33),
                'length'   => 4,
            ),
            array(
                'encoding' => 'UTF-16BE',
                'bom'      => pack('CC', 0xfe, 0xff),
                'length'   => 2,
            ),
            array(
                'encoding' => 'UTF-16LE',
                'bom'      => pack('CC', 0xff, 0xfe),
                'length'   => 2,
            ),
            array(
                'encoding' => 'UTF-8',
                'bom'      => pack('CCC', 0xef, 0xbb, 0xbf),
                'length'   => 3,
            ),
        );
    }

getEntityComparison()

static getEntityComparison (   $xml )

staticprotected

Determine and return the string(s) to use for the <!ENTITY comparison.

Parameters

string

$xml

Returns

string[]

Definition at line 189 of file Security.php.

    {
        $encodingMap = self::getAsciiEncodingMap();
        return array_map(
            array(__CLASS__, 'generateEntityComparison'),
            self::detectXmlEncoding($xml, self::detectStringEncoding($xml))
        );
    }

heuristicScan()

static heuristicScan (   $xml )

staticprotected

Heuristic scan to detect entity in XML

Parameters

string

$xml

Exceptions

Zend_Xml_Exception

If entity expansion or external entity declaration was discovered.

Definition at line 39 of file Security.php.

    {
        foreach (self::getEntityComparison($xml) as $compare) {
            if (strpos($xml, $compare) !== false) {
                throw new Zend_Xml_Exception(self::ENTITY_DETECT);
            }
        }
    }

isPhpFpm()

static isPhpFpm ( )

static

Return true if PHP is running with PHP-FPM

This method is mainly used to determine whether or not heuristic checks (vs libxml checks) should be made, due to threading issues in libxml; under php-fpm, threading becomes a concern.

However, PHP versions 5.5.22+ and 5.6.6+ contain a patch to the libxml support in PHP that makes the libxml checks viable; in such versions, this method will return false to enforce those checks, which are more strict and accurate than the heuristic checks.

Returns

boolean

Definition at line 167 of file Security.php.

    {
        $isVulnerableVersion = (
            version_compare(PHP_VERSION, '5.5.22', 'lt')
            || (
                version_compare(PHP_VERSION, '5.6', 'gte')
                && version_compare(PHP_VERSION, '5.6.6', 'lt')
            )
        );

        if (substr(php_sapi_name(), 0, 3) === 'fpm' && $isVulnerableVersion) {
            return true;
        }
        return false;
    }

loadXmlErrorHandler()

static loadXmlErrorHandler (   $errno,   $errstr,   $errfile,   $errline  )

static

Parameters

integer	$errno
string	$errstr
string	$errfile
integer	$errline

Returns

bool

Definition at line 55 of file Security.php.

    {
        if (substr_count($errstr, 'DOMDocument::loadXML()') > 0) {
            return true;
        }
        return false;
    }

scan()

static scan (   $xml, DOMDocument  $dom = null  )

static

Scan XML string for potential XXE and XEE attacks

Parameters

string	$xml
DomDocument	$dom

Exceptions

Zend_Xml_Exception

Returns

SimpleXMLElement|DomDocument|boolean

Definition at line 71 of file Security.php.

    {
        // If running with PHP-FPM we perform an heuristic scan
        // We cannot use libxml_disable_entity_loader because of this bug
        // @see https://bugs.php.net/bug.php?id=64938
        if (self::isPhpFpm()) {
            self::heuristicScan($xml);
        }

        if (null === $dom) {
            $simpleXml = true;
            $dom = new DOMDocument();
        }

        if (!self::isPhpFpm()) {
            $loadEntities = libxml_disable_entity_loader(true);
            $useInternalXmlErrors = libxml_use_internal_errors(true);
        }

        // Load XML with network access disabled (LIBXML_NONET)
        // error disabled with @ for PHP-FPM scenario
        set_error_handler(array('Zend_Xml_Security', 'loadXmlErrorHandler'), E_WARNING);

        $result = $dom->loadXml($xml, LIBXML_NONET);
        restore_error_handler();

        if (!$result) {
            // Entity load to previous setting
            if (!self::isPhpFpm()) {
                libxml_disable_entity_loader($loadEntities);
                libxml_use_internal_errors($useInternalXmlErrors);
            }
            return false;
        }

        // Scan for potential XEE attacks using ENTITY, if not PHP-FPM
        if (!self::isPhpFpm()) {
            foreach ($dom->childNodes as $child) {
                if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
                    if ($child->entities->length > 0) {
                        #require_once 'Exception.php';
                        throw new Zend_Xml_Exception(self::ENTITY_DETECT);
                    }
                }
            }
        }

        // Entity load to previous setting
        if (!self::isPhpFpm()) {
            libxml_disable_entity_loader($loadEntities);
            libxml_use_internal_errors($useInternalXmlErrors);
        }

        if (isset($simpleXml)) {
            $result = simplexml_import_dom($dom);
            if (!$result instanceof SimpleXMLElement) {
                return false;
            }
            return $result;
        }
        return $dom;
    }

scanFile()

static scanFile (   $file, DOMDocument  $dom = null  )

static

Scan XML file for potential XXE/XEE attacks

Parameters

string	$file
DOMDocument	$dom

Exceptions

Zend_Xml_Exception

Returns

SimpleXMLElement|DomDocument

Definition at line 142 of file Security.php.

    {
        if (!file_exists($file)) {
            #require_once 'Exception.php';
            throw new Zend_Xml_Exception(
                "The file $file specified doesn't exist"
            );
        }
        return self::scan(file_get_contents($file), $dom);
    }

substr()

static substr (   $string,   $start,   $end  )

staticprotected

Binary-safe substr.

substr() is not binary-safe; this method loops by character to ensure multi-byte characters are aggregated correctly.

Parameters

string	$string
int	$start
int	$end

Returns

string

Definition at line 379 of file Security.php.

    {
        $substr = '';
        for ($i = $start; $i < $end; $i += 1) {
            $substr .= $string[$i];
        }
        return $substr;
    }

Field Documentation

ENTITY_DETECT

const ENTITY_DETECT = 'Detected use of ENTITY in XML, disabled to prevent XXE/XEE attacks'

Definition at line 31 of file Security.php.

---

The documentation for this class was generated from the following file:

• vendor/magento/zendframework1/library/Zend/Xml/Security.php