-
Notifications
You must be signed in to change notification settings - Fork 832
Description
Affected page
https://www.php.net/manual/en/libxml.constants.php#constant.libxml-xinclude
Issue description
The PHP documentation mentions the LIBXML_XINCLUDE constant to enable XInclude support in XML parsing here:
https://www.php.net/manual/en/libxml.constants.php#constant.libxml-xinclude
However it does not appear to work. I am not entirely sure whether this is intentional (then it would be a documentation issue) or whether there's an expectation for it to work (then it should be considered a bug in the code).
I imagine it might be intentional, as Xinclude is a rarely used and potentially very dangerous feature, so I will report it here, assuming it should be properly documented.
Note that this has already been mentioned in a comment here a long time ago:
https://www.php.net/manual/en/function.simplexml-load-string.php#77713
Here's example code that should output the content of /etc/passwd (and does not do that):
#!/usr/bin/php
<?php
$xmlcontent = <<<EOF
<x xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/>
</x>
EOF;
$sx = new SimpleXMLElement($xmlcontent, LIBXML_XINCLUDE);
print($sx->asXML());
### Steps to reproduce
1. Go to
https://www.php.net/manual/en/libxml.constants.php#constant.libxml-xinclude
2. Try to write code using simplexml and that constant
3. does not include anything
### Suggested fix
Either documentation should mention that this is effectively unsupported and a NOOP or it should be supported (if so, please add a warning in the docs that it can be dangerous due to XXE attacks).