1--TEST-- 2GHSA-3qrf-m4j2-pcrr (libxml global state entity loader bypass) 3--EXTENSIONS-- 4dom 5libxml 6zend_test 7--SKIPIF-- 8<?php 9if (!function_exists('zend_test_override_libxml_global_state')) die('skip not for Windows'); 10?> 11--FILE-- 12<?php 13 14$xml = "<?xml version='1.0'?><!DOCTYPE root [<!ENTITY % bork SYSTEM \"php://nope\"> %bork;]><nothing/>"; 15 16libxml_use_internal_errors(true); 17 18function parseXML($xml) { 19 $doc = new DOMDocument(); 20 @$doc->loadXML($xml); 21 $doc->createDocumentFragment()->appendXML("&bork;"); 22 foreach (libxml_get_errors() as $error) { 23 var_dump(trim($error->message)); 24 } 25} 26 27parseXML($xml); 28zend_test_override_libxml_global_state(); 29parseXML($xml); 30 31echo "Done\n"; 32 33?> 34--EXPECT-- 35string(25) "Entity 'bork' not defined" 36string(25) "Entity 'bork' not defined" 37string(25) "Entity 'bork' not defined" 38Done 39