From 68d0756c596baeefad0b733b42ef2657d09c7f4e Mon Sep 17 00:00:00 2001 From: Enrico Zimuel Date: Fri, 28 Feb 2014 16:47:52 +0100 Subject: [PATCH] Use external ZendXml\Security --- composer.json | 3 +- library/Zend/Json/Json.php | 2 +- .../Zend/Xml/Exception/ExceptionInterface.php | 14 -- .../Exception/InvalidArgumentException.php | 19 --- .../Zend/Xml/Exception/RuntimeException.php | 19 --- library/Zend/Xml/Security.php | 84 ----------- library/Zend/XmlRpc/Fault.php | 4 +- library/Zend/XmlRpc/Response.php | 4 +- tests/ZendTest/Xml/SecurityTest.php | 139 ------------------ 9 files changed, 7 insertions(+), 281 deletions(-) delete mode 100644 library/Zend/Xml/Exception/ExceptionInterface.php delete mode 100644 library/Zend/Xml/Exception/InvalidArgumentException.php delete mode 100644 library/Zend/Xml/Exception/RuntimeException.php delete mode 100644 library/Zend/Xml/Security.php delete mode 100644 tests/ZendTest/Xml/SecurityTest.php diff --git a/composer.json b/composer.json index bea42c3c828..1ee756267ae 100644 --- a/composer.json +++ b/composer.json @@ -9,7 +9,8 @@ "homepage": "http://framework.zend.com/", "license": "BSD-3-Clause", "require": { - "php": ">=5.3.3" + "php": ">=5.3.3", + "zendframework/zendxml": "dev-master" }, "require-dev": { "doctrine/annotations": ">=1.0", diff --git a/library/Zend/Json/Json.php b/library/Zend/Json/Json.php index 89cff9e0585..1bb15794867 100644 --- a/library/Zend/Json/Json.php +++ b/library/Zend/Json/Json.php @@ -12,7 +12,7 @@ use SimpleXMLElement; use Zend\Json\Exception\RecursionException; use Zend\Json\Exception\RuntimeException; -use Zend\Xml\Security as XmlSecurity; +use ZendXml\Security as XmlSecurity; /** * Class for encoding to and decoding from JSON. diff --git a/library/Zend/Xml/Exception/ExceptionInterface.php b/library/Zend/Xml/Exception/ExceptionInterface.php deleted file mode 100644 index 755ef6e0596..00000000000 --- a/library/Zend/Xml/Exception/ExceptionInterface.php +++ /dev/null @@ -1,14 +0,0 @@ -loadXml($xml)) { - // Entity load to previous setting - libxml_disable_entity_loader($loadEntities); - libxml_use_internal_errors($useInternalXmlErrors); - return false; - } - - // Scan for potential XEE attacks using Entity - foreach ($dom->childNodes as $child) { - if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) { - if ($child->entities->length > 0) { - throw new Exception\RuntimeException( - 'Detected use of ENTITY_NODE in XML, disabled to prevent XEE attacks' - ); - } - } - } - - // Entity load to previous setting - libxml_disable_entity_loader($loadEntities); - libxml_use_internal_errors($useInternalXmlErrors); - - if (isset($simpleXml)) { - $result = simplexml_import_dom($dom); - if (!$result instanceof SimpleXMLElement) { - return false; - } - return $result; - } - return $dom; - } - - /** - * Scan XML file for potential XXE/XEE attacks - * - * @param string $file - * @param DOMDocument $dom - * @throws Exception\InvalidArgumentException - * @return SimpleXMLElement|DomDocument - */ - public static function scanFile($file, DOMDocument $dom = null) - { - if (!file_exists($file)) { - throw new Exception\InvalidArgumentException( - "The file $file specified doesn't exist" - ); - } - return self::scan(file_get_contents($file), $dom); - } -} diff --git a/library/Zend/XmlRpc/Fault.php b/library/Zend/XmlRpc/Fault.php index 9af84a2281d..bb1880118e2 100644 --- a/library/Zend/XmlRpc/Fault.php +++ b/library/Zend/XmlRpc/Fault.php @@ -10,7 +10,7 @@ namespace Zend\XmlRpc; use SimpleXMLElement; -use Zend\Xml\Security as XmlSecurity; +use ZendXml\Security as XmlSecurity; /** * XMLRPC Faults @@ -182,7 +182,7 @@ public function loadXml($fault) $xmlErrorsFlag = libxml_use_internal_errors(true); try { $xml = XmlSecurity::scan($fault); - } catch (\Zend\Xml\Exception\RuntimeException $e) { + } catch (\ZendXml\Exception\RuntimeException $e) { // Unsecure XML throw new Exception\RuntimeException('Failed to parse XML fault: ' . $e->getMessage(), 500, $e); } diff --git a/library/Zend/XmlRpc/Response.php b/library/Zend/XmlRpc/Response.php index 241df1a741d..f8537584e41 100644 --- a/library/Zend/XmlRpc/Response.php +++ b/library/Zend/XmlRpc/Response.php @@ -9,7 +9,7 @@ namespace Zend\XmlRpc; -use Zend\Xml\Security as XmlSecurity; +use ZendXml\Security as XmlSecurity; /** * XmlRpc Response @@ -155,7 +155,7 @@ public function loadXml($response) try { $xml = XmlSecurity::scan($response); - } catch (\Zend\Xml\Exception\RuntimeException $e) { + } catch (\ZendXml\Exception\RuntimeException $e) { $this->fault = new Fault(651); $this->fault->setEncoding($this->getEncoding()); return false; diff --git a/tests/ZendTest/Xml/SecurityTest.php b/tests/ZendTest/Xml/SecurityTest.php deleted file mode 100644 index 5f7a5505a63..00000000000 --- a/tests/ZendTest/Xml/SecurityTest.php +++ /dev/null @@ -1,139 +0,0 @@ - -]> - - This result is &harmless; - -XML; - - $this->setExpectedException('Zend\Xml\Exception\RuntimeException'); - $result = XmlSecurity::scan($xml); - } - - public function testScanForXXE() - { - $file = tempnam(sys_get_temp_dir(), 'Zend_XML_Security'); - file_put_contents($file, 'This is a remote content!'); - $xml = << - -]> - - &foo; - -XML; - - try { - $result = XmlSecurity::scan($xml); - } catch (Exception\RuntimeException $e) { - unlink($file); - return; - } - $this->fail('An expected exception has not been raised.'); - } - - public function testScanSimpleXmlResult() - { - $result = XmlSecurity::scan($this->_getXml()); - $this->assertTrue($result instanceof SimpleXMLElement); - $this->assertEquals($result->result, 'test'); - } - - public function testScanDom() - { - $dom = new DOMDocument('1.0'); - $result = XmlSecurity::scan($this->_getXml(), $dom); - $this->assertTrue($result instanceof DOMDocument); - $node = $result->getElementsByTagName('result')->item(0); - $this->assertEquals($node->nodeValue, 'test'); - } - - public function testScanInvalidXml() - { - $xml = <<test -XML; - - $result = XmlSecurity::scan($xml); - $this->assertFalse($result); - } - - public function testScanInvalidXmlDom() - { - $xml = <<test -XML; - - $dom = new DOMDocument('1.0'); - $result = XmlSecurity::scan($xml, $dom); - $this->assertFalse($result); - } - - public function testScanFile() - { - $file = tempnam(sys_get_temp_dir(), 'Zend_XML_Security'); - file_put_contents($file, $this->_getXml()); - - $result = XmlSecurity::scanFile($file); - $this->assertTrue($result instanceof SimpleXMLElement); - $this->assertEquals($result->result, 'test'); - unlink($file); - } - - public function testScanXmlWithDTD() - { - $xml = << - - -]> - - test - -XML; - - $dom = new DOMDocument('1.0'); - $result = XmlSecurity::scan($xml, $dom); - $this->assertTrue($result instanceof DOMDocument); - $this->assertTrue($result->validate()); - } - - protected function _getXml() - { - return << - - test - -XML; - - } -}