jenkins-bot has submitted this change and it was merged. Change subject: Disable external entity loading in libxml ......................................................................
Disable external entity loading in libxml Per comments on https://gerrit.wikimedia.org/r/#/c/99164/ we should be disabling entity loading via libxml_disable_entity_loader Change-Id: I2d50c837e828808c572220a86d35f13f44022a7e --- M includes/ParsoidUtils.php 1 file changed, 5 insertions(+), 2 deletions(-) Approvals: CSteipp: Looks good to me, but someone else must approve Matthias Mullie: Looks good to me, approved jenkins-bot: Verified diff --git a/includes/ParsoidUtils.php b/includes/ParsoidUtils.php index 9e2bea9..1899a57 100644 --- a/includes/ParsoidUtils.php +++ b/includes/ParsoidUtils.php @@ -177,14 +177,17 @@ public static function createDOM( $content, $ignoreErrorCodes = array( 801 ) ) { $dom = new \DOMDocument(); - // Otherwise the parser may attempt to load the dtd from an external source - $dom->resolveExternals = false; + // Otherwise the parser may attempt to load the dtd from an external source. + // See: https://www.mediawiki.org/wiki/XML_External_Entity_Processing + $loadEntities = libxml_disable_entity_loader( true ); // don't output warnings $useErrors = libxml_use_internal_errors( true ); $dom->loadHTML( $content ); + libxml_disable_entity_loader( $loadEntities ); + // check error codes; if not in the supplied list of ignorable errors, // throw an exception $errors = array_filter( -- To view, visit https://gerrit.wikimedia.org/r/100904 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: I2d50c837e828808c572220a86d35f13f44022a7e Gerrit-PatchSet: 2 Gerrit-Project: mediawiki/extensions/Flow Gerrit-Branch: master Gerrit-Owner: EBernhardson <[email protected]> Gerrit-Reviewer: CSteipp <[email protected]> Gerrit-Reviewer: Matthias Mullie <[email protected]> Gerrit-Reviewer: jenkins-bot _______________________________________________ MediaWiki-commits mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
