1 <?php

     2 /**

     3  * Zend Framework

     4  *

     5  * LICENSE

     6  *

     7  * This source file is subject to the new BSD license that is bundled

     8  * with this package in the file LICENSE.txt.

     9  * It is also available through the world-wide-web at this URL:

    10  * http://framework.zend.com/license/new-bsd

    11  * If you did not receive a copy of the license and are unable to

    12  * obtain it through the world-wide-web, please send an email

    13  * to license@zend.com so we can send you a copy immediately.

    14  *

    15  * @category   Zend

    16  * @package    Zend_Xml

    17  * @copyright  Copyright (c) 2005-2015 Zend Technologies USA Inc. (http://www.zend.com)

    18  * @license    http://framework.zend.com/license/new-bsd     New BSD License

    19  * @version    $Id$

    20  */

    21 

    22  

    23 /**

    24  * @category   Zend

    25  * @package    Zend_Xml_SecurityScan

    26  * @copyright  Copyright (c) 2005-2015 Zend Technologies USA Inc. (http://www.zend.com)

    27  * @license    http://framework.zend.com/license/new-bsd     New BSD License

    28  */

    29 class Zend_Xml_Security

    30 {

    31     const ENTITY_DETECT = 'Detected use of ENTITY in XML, disabled to prevent XXE/XEE attacks';

    32 

    33     /**

    34      * Heuristic scan to detect entity in XML

    35      *

    36      * @param  string $xml

    37      * @throws Zend_Xml_Exception

    38      */

    39     protected static function heuristicScan($xml)

    40     {

    41         if (strpos($xml, '<!ENTITY') !== false) {

    42             require_once 'Exception.php';

    43             throw new Zend_Xml_Exception(self::ENTITY_DETECT);

    44         }

    45     }

    46 

    47     /**

    48      * @param integer $errno

    49      * @param string $errstr

    50      * @param string $errfile

    51      * @param integer $errline

    52      * @return bool

    53      */

    54     public static function loadXmlErrorHandler($errno, $errstr, $errfile, $errline)

    55     {

    56         if (substr_count($errstr, 'DOMDocument::loadXML()') > 0) {

    57             return true;

    58         }

    59         return false;

    60     }

    61 

    62     /**

    63      * Scan XML string for potential XXE and XEE attacks

    64      *

    65      * @param   string $xml

    66      * @param   DomDocument $dom

    67      * @throws  Zend_Xml_Exception

    68      * @return  SimpleXMLElement|DomDocument|boolean

    69      */

    70     public static function scan($xml, DOMDocument $dom = null)

    71     {

    72         // If running with PHP-FPM we perform an heuristic scan

    73         // We cannot use libxml_disable_entity_loader because of this bug

    74         // @see https://bugs.php.net/bug.php?id=64938

    75         if (self::isPhpFpm()) {

    76             self::heuristicScan($xml);

    77         }

    78 

    79         if (null === $dom) {

    80             $simpleXml = true;

    81             $dom = new DOMDocument();

    82         }

    83 

    84         if (!self::isPhpFpm()) {

    85             $loadEntities = libxml_disable_entity_loader(true);

    86             $useInternalXmlErrors = libxml_use_internal_errors(true);

    87         }

    88 

    89         // Load XML with network access disabled (LIBXML_NONET)

    90         // error disabled with @ for PHP-FPM scenario

    91         set_error_handler(array('Zend_Xml_Security', 'loadXmlErrorHandler'), E_WARNING);

    92 

    93         $result = $dom->loadXml($xml, LIBXML_NONET);

    94         restore_error_handler();

    95 

    96         // Entity load to previous setting

    97         if (!self::isPhpFpm()) {

    98             libxml_disable_entity_loader($loadEntities);

    99             libxml_use_internal_errors($useInternalXmlErrors);

   100         }

   101 

   102         if (!$result) {

   103             return false;

   104         }

   105 

   106         // Scan for potential XEE attacks using ENTITY, if not PHP-FPM

   107         if (!self::isPhpFpm()) {

   108             foreach ($dom->childNodes as $child) {

   109                 if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {

   110                     if ($child->entities->length > 0) {

   111                         require_once 'Exception.php';

   112                         throw new Zend_Xml_Exception(self::ENTITY_DETECT);

   113                     }

   114                 }

   115             }

   116         }

   117 

   118         if (isset($simpleXml)) {

   119             $result = simplexml_import_dom($dom);

   120             if (!$result instanceof SimpleXMLElement) {

   121                 return false;

   122             }

   123             return $result;

   124         }

   125         return $dom;

   126     }

   127 

   128     /**

   129      * Scan XML file for potential XXE/XEE attacks

   130      *

   131      * @param  string $file

   132      * @param  DOMDocument $dom

   133      * @throws Zend_Xml_Exception

   134      * @return SimpleXMLElement|DomDocument

   135      */

   136     public static function scanFile($file, DOMDocument $dom = null)

   137     {

   138         if (!file_exists($file)) {

   139             require_once 'Exception.php';

   140             throw new Zend_Xml_Exception(

   141                 "The file $file specified doesn't exist"

   142             );

   143         }

   144         return self::scan(file_get_contents($file), $dom);

   145     }

   146 

   147     /**

   148      * Return true if PHP is running with PHP-FPM

   149      *

   150      * @return boolean

   151      */

   152     public static function isPhpFpm()

   153     {

   154         if (substr(php_sapi_name(), 0, 3) === 'fpm') {

   155             return true;

   156         }

   157         return false;

   158     }

   159 }