libxml_disable_entity_loader

(PHP 5 >= 5.2.11, PHP 7, PHP 8)

libxml_disable_entity_loaderDesabilita a capacidade de carregar entidades externas

Aviso

Esta função tornou-se DEFASADA a partir do PHP 8.0.0. O uso desta função é fortemente desencorajado.

Descrição

libxml_disable_entity_loader(bool $disable = true): bool

Desabilita/habilita a capacidade de carregar entidades externas. Observe que desabilitar o carregamento de entidades externas pode causar problemas gerais com carregamento de documentos XML. Entretanto, a partir da libxml 2.9.0, substituição de entidade está desabilitada por padrão, portanto não é necessário desabilitari o carregamento de entidades externas, a menos que haja necessidade de resolver referências de entidades internas com LIBXML_NOENT. Geralmente, é preferível usar libxml_set_external_entity_loader() para suprimir carregamento de entidades externas.

Parâmetros

disable

Desabilita (true) ou habilita (false) a capacidade de extensões libxml (como DOM, XMLWriter e XMLReader) carregarem entidades externas.

Valor Retornado

Retorna o valor anterior.

Veja Também

add a note add a note

User Contributed Notes 6 notes

up
9
vavra at 602 dot cz
6 years ago
If is called
libxml_disable_entity_loader(true);

, it causes that new SoapClient(.) fails with

SOAP-ERROR: Parsing WSDL: Couldn't load from 'D:\path/dm_operations.wsdl' : failed to load external entity "D:\path/dm_operations.wsdl

because this wsdl imports a xsd as an another external file.
Tested on php 7.1.12, win x64.
up
3
suconghou at gmail dot com
3 years ago
In PHP 8.0 and later, PHP uses libxml versions from 2.9.0, libxml_disable_entity_loader is deprecated.
so it is now safe to remove all `libxml_disable_entity_loader` calls on php8

if you want Backwards Compatibility

use this snippet

if (\PHP_VERSION_ID < 80000) {
    libxml_disable_entity_loader(true);
}
up
3
simonsimcity
12 years ago
Using this function you can prevent a vulnerable to Local and Remote File Inclusion attacks.

You'll see it in an example where I load and validate the following string:

<!DOCTYPE scan [<!ENTITY test SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">]>
<scan>&test;</scan>

One way to prevent that the file in given back is to set this value to 0.
Please take a closer look at the release of symfony 2.0.11
up
2
phofstetter at sensational dot ch
10 years ago
Be mindful that this also disables url loading in simplexml_load_file() and likely other libxml based functions that deal with URLs
up
-2
brendan at bloodbone dot ws
9 years ago
This also seems to have an impact on <xsl:import /> statements if this is applied when loading XSLT for the XSLTProcessor class.
up
-6
daschtour at me dot com
10 years ago
This function was reported to be not thread safe. So this might affect php-scripts on the same server.
To Top