1--TEST-- 2UAF when removing doctype and iterating over the child nodes 3--EXTENSIONS-- 4dom 5--CREDITS-- 6Yuancheng Jiang 7--FILE-- 8<?php 9$dom = new DOMDocument; 10$dom->loadXML(<<<XML 11<!DOCTYPE foo [ 12 <!ENTITY foo1 "bar1"> 13]> 14<foo>&foo1;</foo> 15XML); 16$ref = $dom->documentElement->firstChild; 17$nodes = $ref->childNodes; 18$dom->removeChild($dom->doctype); 19foreach($nodes as $str) {} 20var_dump($nodes); 21?> 22--EXPECTF-- 23object(DOMNodeList)#%d (1) { 24 ["length"]=> 25 int(0) 26} 27