12

I have PHP code that uses the loadXML function (as well as other XML functions).

  1. Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be interpreted?

  2. Is this function vulnerable to other XML based attacks? E.g., the Billion Laughs DoS attack?

  3. Can you refer me to a list of functions that are vulnerable to XXE and to other XML-related attacks?

I know that it is possible to easily block XXE attacks in PHP by changing the settings. Yet, I will be glad to get answers to the questions I raised.

2
  • 1
    Some of these like the DoS attack can easily be tested by yourself. Aug 15, 2016 at 9:07
  • Being it PHP, I can give a much shorter lists of functions that are not vulnerable.
    – Kroltan
    Aug 15, 2016 at 20:49

1 Answer 1

14

Is the loadXML function vulnerable to XXE attack? Namely, if the XML contains external entities, will they be interpreted?

By default, no.

External Entities are not parsed without LIBXML_NOENT being set. If libxml_disable_entity_loader is set to true, not even LIBXML_NOENT will allow XXE.

Is this function vulnerable to other XML based attacks? e.g., the Billion Laughs DoS attack?

No, billion laughts will be caught with default settings:

DOMDocument::loadXML(): Detected an entity reference loop in Entity

What will not be caught is quadratic blowup. Note that the entities need to actually be substituted, which is either done via the rather poorly named LIBXML_NOENT or by simply accessing the node (eg via textContent).

8
  • 7
    The name of this flag is so horribly confusing, as is the complete lack of official documentation.
    – Polynomial
    Aug 15, 2016 at 10:58
  • 21
    @Polynomial: Welcome to PHP. Aug 15, 2016 at 12:04
  • 5
    @WillihamTotland PHP is pretty awful regarding naming and documenting. But noent is already present in libxml (at least as parameter in their command line tool, and the other bindings such as ruby use the same flag as well).
    – tim
    Aug 15, 2016 at 12:17
  • 9
    @tim A poorly named, poorly document flag that can't be blamed on PHP? Frankly, I never thought I'd see the day. ;) Aug 15, 2016 at 12:22
  • An example of quadratic blowup: the billion lulz attack. Aug 15, 2016 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .