Disable XXE on WDDX serializer.

zendframework · Aug 1, 2012 · 8447f03 · 8447f03
1 parent 7c51444
commit 8447f03
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/library/Zend/Serializer/Adapter/Wddx.php b/library/Zend/Serializer/Adapter/Wddx.php
@@ -114,7 +114,9 @@ public function unserialize($wddx)
             // check if the returned NULL is valid
             // or based on an invalid wddx string
             try {
+                libxml_disable_entity_loader(true);
                 $simpleXml = new \SimpleXMLElement($wddx);
+                libxml_disable_entity_loader(false);
                 if (isset($simpleXml->data[0]->null[0])) {
                     return null; // valid null
                 }