jenkins-bot has submitted this change and it was merged.

Change subject: Disable external entity loading in libxml
......................................................................


Disable external entity loading in libxml

Per comments on https://gerrit.wikimedia.org/r/#/c/99164/ we
should be disabling entity loading via libxml_disable_entity_loader

Change-Id: I2d50c837e828808c572220a86d35f13f44022a7e
---
M includes/ParsoidUtils.php
1 file changed, 5 insertions(+), 2 deletions(-)

Approvals:
  CSteipp: Looks good to me, but someone else must approve
  Matthias Mullie: Looks good to me, approved
  jenkins-bot: Verified



diff --git a/includes/ParsoidUtils.php b/includes/ParsoidUtils.php
index 9e2bea9..1899a57 100644
--- a/includes/ParsoidUtils.php
+++ b/includes/ParsoidUtils.php
@@ -177,14 +177,17 @@
        public static function createDOM( $content, $ignoreErrorCodes = array( 
801 ) ) {
                $dom = new \DOMDocument();
 
-               // Otherwise the parser may attempt to load the dtd from an 
external source
-               $dom->resolveExternals = false;
+               // Otherwise the parser may attempt to load the dtd from an 
external source.
+               // See: 
https://www.mediawiki.org/wiki/XML_External_Entity_Processing
+               $loadEntities = libxml_disable_entity_loader( true );
 
                // don't output warnings
                $useErrors = libxml_use_internal_errors( true );
 
                $dom->loadHTML( $content );
 
+               libxml_disable_entity_loader( $loadEntities );
+
                // check error codes; if not in the supplied list of ignorable 
errors,
                // throw an exception
                $errors = array_filter(

-- 
To view, visit https://gerrit.wikimedia.org/r/100904
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: I2d50c837e828808c572220a86d35f13f44022a7e
Gerrit-PatchSet: 2
Gerrit-Project: mediawiki/extensions/Flow
Gerrit-Branch: master
Gerrit-Owner: EBernhardson <[email protected]>
Gerrit-Reviewer: CSteipp <[email protected]>
Gerrit-Reviewer: Matthias Mullie <[email protected]>
Gerrit-Reviewer: jenkins-bot

_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits

Reply via email to