diff --git a/reference/libxml/constants.xml b/reference/libxml/constants.xml index 507946f3e5fd..261846565cda 100644 --- a/reference/libxml/constants.xml +++ b/reference/libxml/constants.xml @@ -46,6 +46,12 @@ Default DTD attributes + + + Enabling loading of DTD attributes will enable fetching of external entities. + The LIBXML_NO_XXE constant can be used to prevent this (only available in Libxml >= 2.13.0, as of PHP 8.4.0). + + @@ -57,6 +63,12 @@ Load the external subset + + + Enabling loading of external subsets will enable fetching of external entities. + The LIBXML_NO_XXE constant can be used to prevent this (only available in Libxml >= 2.13.0, as of PHP 8.4.0). + + @@ -71,6 +83,7 @@ Enabling validating the DTD may facilitate XML External Entity (XXE) attacks. + The LIBXML_NO_XXE constant can be used to prevent this (only available in Libxml >= 2.13.0, as of PHP 8.4.0). diff --git a/reference/libxml/functions/libxml-disable-entity-loader.xml b/reference/libxml/functions/libxml-disable-entity-loader.xml index 8d9d4ab2e7e7..d4e605d92f60 100644 --- a/reference/libxml/functions/libxml-disable-entity-loader.xml +++ b/reference/libxml/functions/libxml-disable-entity-loader.xml @@ -20,12 +20,17 @@ Disable/enable the ability to load external entities. Note that disabling the loading of external entities may cause general issues - with loading XML documents. However, as of libxml 2.9.0 entity substitution + with loading XML documents. + + + As of libxml 2.9.0 entity substitution is disabled by default, so there is no need to disable the loading of external entities, - unless there is the need to resolve internal entity references with LIBXML_NOENT. + unless there is the need to resolve internal entity references with LIBXML_NOENT, + LIBXML_DTDVALID, or LIBXML_DTDLOAD. Generally, it is preferable to use libxml_set_external_entity_loader to suppress loading of external entities. + The LIBXML_NO_XXE constant can be used to prevent this as well (only available in Libxml >= 2.13.0, as of PHP 8.4.0). @@ -99,7 +104,9 @@ libxml_use_internal_errors libxml_set_external_entity_loader - The LIBXML_NOENT constant + The LIBXML_NOENT constant + The LIBXML_DTDVALID constant + The LIBXML_NO_XXE constant