File indexing completed on 2024-12-22 05:37:14

 <?php
 /**
  * Zend Framework
  *
  * LICENSE
  *
  * This source file is subject to the new BSD license that is bundled
  * with this package in the file LICENSE.txt.
  * It is also available through the world-wide-web at this URL:
  * http://framework.zend.com/license/new-bsd
  * If you did not receive a copy of the license and are unable to
  * obtain it through the world-wide-web, please send an email
  * to license@zend.com so we can send you a copy immediately.
  *
  * @category   Zend
  * @package    Zend_Xml
  * @copyright  Copyright (c) 2005-2015 Zend Technologies USA Inc. (http://www.zend.com)
  * @license    http://framework.zend.com/license/new-bsd     New BSD License
  * @version    $Id$
  */
 
  
 /**
  * @category   Zend
  * @package    Zend_Xml_SecurityScan
  * @copyright  Copyright (c) 2005-2015 Zend Technologies USA Inc. (http://www.zend.com)
  * @license    http://framework.zend.com/license/new-bsd     New BSD License
  */
 class Zend_Xml_Security
 {
     const ENTITY_DETECT = 'Detected use of ENTITY in XML, disabled to prevent XXE/XEE attacks';
 
     /**
      * Heuristic scan to detect entity in XML
      *
      * @param  string $xml
      * @throws Zend_Xml_Exception If entity expansion or external entity declaration was discovered.
      */
     protected static function heuristicScan($xml)
     {
         foreach (self::getEntityComparison($xml) as $compare) {
             if (strpos($xml, $compare) !== false) {
                 throw new Zend_Xml_Exception(self::ENTITY_DETECT);
             }
         }
     }
 
     /**
      * @param integer $errno
      * @param string $errstr
      * @param string $errfile
      * @param integer $errline
      * @return bool
      */
     public static function loadXmlErrorHandler($errno, $errstr, $errfile, $errline)
     {
         if (substr_count($errstr, 'DOMDocument::loadXML()') > 0) {
             return true;
         }
         return false;
     }
 
     /**
      * Scan XML string for potential XXE and XEE attacks
      *
      * @param   string $xml
      * @param   DomDocument $dom
      * @throws  Zend_Xml_Exception
      * @return  SimpleXMLElement|DomDocument|boolean
      */
     public static function scan($xml, DOMDocument $dom = null)
     {
         // If running with PHP-FPM we perform an heuristic scan
         // We cannot use libxml_disable_entity_loader because of this bug
         // @see https://bugs.php.net/bug.php?id=64938
         if (self::isPhpFpm()) {
             self::heuristicScan($xml);
         }
 
         if (null === $dom) {
             $simpleXml = true;
             $dom = new DOMDocument();
         }
 
         if (!self::isPhpFpm()) {
             $loadEntities = libxml_disable_entity_loader(true);
             $useInternalXmlErrors = libxml_use_internal_errors(true);
         }
 
         // Load XML with network access disabled (LIBXML_NONET)
         // error disabled with @ for PHP-FPM scenario
         set_error_handler(array('Zend_Xml_Security', 'loadXmlErrorHandler'), E_WARNING);
 
         $result = $dom->loadXml($xml, LIBXML_NONET);
         restore_error_handler();
 
         if (!$result) {
             // Entity load to previous setting
             if (!self::isPhpFpm()) {
                 libxml_disable_entity_loader($loadEntities);
                 libxml_use_internal_errors($useInternalXmlErrors);
             }
             return false;
         }
 
         // Scan for potential XEE attacks using ENTITY, if not PHP-FPM
         if (!self::isPhpFpm()) {
             foreach ($dom->childNodes as $child) {
                 if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
                     if ($child->entities->length > 0) {
                         // require_once 'Exception.php';
                         throw new Zend_Xml_Exception(self::ENTITY_DETECT);
                     }
                 }
             }
         }
 
         // Entity load to previous setting
         if (!self::isPhpFpm()) {
             libxml_disable_entity_loader($loadEntities);
             libxml_use_internal_errors($useInternalXmlErrors);
         }
 
         if (isset($simpleXml)) {
             $result = simplexml_import_dom($dom);
             if (!$result instanceof SimpleXMLElement) {
                 return false;
             }
             return $result;
         }
         return $dom;
     }
 
     /**
      * Scan XML file for potential XXE/XEE attacks
      *
      * @param  string $file
      * @param  DOMDocument $dom
      * @throws Zend_Xml_Exception
      * @return SimpleXMLElement|DomDocument
      */
     public static function scanFile($file, DOMDocument $dom = null)
     {
         if (!file_exists($file)) {
             // require_once 'Exception.php';
             throw new Zend_Xml_Exception(
                 "The file $file specified doesn't exist"
             );
         }
         return self::scan(file_get_contents($file), $dom);
     }
 
     /**
      * Return true if PHP is running with PHP-FPM
      *
      * This method is mainly used to determine whether or not heuristic checks
      * (vs libxml checks) should be made, due to threading issues in libxml;
      * under php-fpm, threading becomes a concern.
      *
      * However, PHP versions 5.5.22+ and 5.6.6+ contain a patch to the
      * libxml support in PHP that makes the libxml checks viable; in such
      * versions, this method will return false to enforce those checks, which
      * are more strict and accurate than the heuristic checks.
      *
      * @return boolean
      */
     public static function isPhpFpm()
     {
         $isVulnerableVersion = (
             version_compare(PHP_VERSION, '5.5.22', 'lt')
             || (
                 version_compare(PHP_VERSION, '5.6', 'gte')
                 && version_compare(PHP_VERSION, '5.6.6', 'lt')
             )
         );
 
         if (substr(php_sapi_name(), 0, 3) === 'fpm' && $isVulnerableVersion) {
             return true;
         }
         return false;
     }
 
     /**
      * Determine and return the string(s) to use for the <!ENTITY comparison.
      *
      * @param string $xml
      * @return string[]
      */
     protected static function getEntityComparison($xml)
     {
         $encodingMap = self::getAsciiEncodingMap();
         return array_map(
             array(__CLASS__, 'generateEntityComparison'),
             self::detectXmlEncoding($xml, self::detectStringEncoding($xml))
         );
     }
 
     /**
      * Determine the string encoding.
      *
      * Determines string encoding from either a detected BOM or a
      * heuristic.
      *
      * @param string $xml
      * @return string File encoding
      */
     protected static function detectStringEncoding($xml)
     {
         $encoding = self::detectBom($xml);
         return ($encoding) ? $encoding : self::detectXmlStringEncoding($xml);
     }
 
     /**
      * Attempt to match a known BOM.
      *
      * Iterates through the return of getBomMap(), comparing the initial bytes
      * of the provided string to the BOM of each; if a match is determined,
      * it returns the encoding.
      *
      * @param string $string
      * @return false|string Returns encoding on success.
      */
     protected static function detectBom($string)
     {
         foreach (self::getBomMap() as $criteria) {
             if (0 === strncmp($string, $criteria['bom'], $criteria['length'])) {
                 return $criteria['encoding'];
             }
         }
         return false;
     }
 
     /**
      * Attempt to detect the string encoding of an XML string.
      *
      * @param string $xml
      * @return string Encoding
      */
     protected static function detectXmlStringEncoding($xml)
     {
         foreach (self::getAsciiEncodingMap() as $encoding => $generator) {
             $prefix = call_user_func($generator, '<' . '?xml');
             if (0 === strncmp($xml, $prefix, strlen($prefix))) {
                 return $encoding;
             }
         }
 
         // Fallback
         return 'UTF-8';
     }
 
     /**
      * Attempt to detect the specified XML encoding.
      *
      * Using the file's encoding, determines if an "encoding" attribute is
      * present and well-formed in the XML declaration; if so, it returns a
      * list with both the ASCII representation of that declaration and the
      * original file encoding.
      *
      * If not, a list containing only the provided file encoding is returned.
      *
      * @param string $xml
      * @param string $fileEncoding
      * @return string[] Potential XML encodings
      */
     protected static function detectXmlEncoding($xml, $fileEncoding)
     {
         $encodingMap = self::getAsciiEncodingMap();
         $generator   = $encodingMap[$fileEncoding];
         $encAttr     = call_user_func($generator, 'encoding="');
         $quote       = call_user_func($generator, '"');
         $close       = call_user_func($generator, '>');
 
         $closePos    = strpos($xml, $close);
         if (false === $closePos) {
             return array($fileEncoding);
         }
 
         $encPos = strpos($xml, $encAttr);
         if (false === $encPos
             || $encPos > $closePos
         ) {
             return array($fileEncoding);
         }
 
         $encPos   += strlen($encAttr);
         $quotePos = strpos($xml, $quote, $encPos);
         if (false === $quotePos) {
             return array($fileEncoding);
         }
 
         $encoding = self::substr($xml, $encPos, $quotePos);
         return array(
             // Following line works because we're only supporting 8-bit safe encodings at this time.
             str_replace('\0', '', $encoding), // detected encoding
             $fileEncoding,                    // file encoding
         );
     }
 
     /**
      * Return a list of BOM maps.
      *
      * Returns a list of common encoding -> BOM maps, along with the character
      * length to compare against.
      *
      * @link https://en.wikipedia.org/wiki/Byte_order_mark
      * @return array
      */
     protected static function getBomMap()
     {
         return array(
             array(
                 'encoding' => 'UTF-32BE',
                 'bom'      => pack('CCCC', 0x00, 0x00, 0xfe, 0xff),
                 'length'   => 4,
             ),
             array(
                 'encoding' => 'UTF-32LE',
                 'bom'      => pack('CCCC', 0xff, 0xfe, 0x00, 0x00),
                 'length'   => 4,
             ),
             array(
                 'encoding' => 'GB-18030',
                 'bom'      => pack('CCCC', 0x84, 0x31, 0x95, 0x33),
                 'length'   => 4,
             ),
             array(
                 'encoding' => 'UTF-16BE',
                 'bom'      => pack('CC', 0xfe, 0xff),
                 'length'   => 2,
             ),
             array(
                 'encoding' => 'UTF-16LE',
                 'bom'      => pack('CC', 0xff, 0xfe),
                 'length'   => 2,
             ),
             array(
                 'encoding' => 'UTF-8',
                 'bom'      => pack('CCC', 0xef, 0xbb, 0xbf),
                 'length'   => 3,
             ),
         );
     }
 
     /**
      * Return a map of encoding => generator pairs.
      *
      * Returns a map of encoding => generator pairs, where the generator is a
      * callable that accepts a string and returns the appropriate byte order
      * sequence of that string for the encoding.
      *
      * @return array
      */
     protected static function getAsciiEncodingMap()
     {
         return array(
             'UTF-32BE'   => array(__CLASS__, 'encodeToUTF32BE'),
             'UTF-32LE'   => array(__CLASS__, 'encodeToUTF32LE'),
             'UTF-32odd1' => array(__CLASS__, 'encodeToUTF32odd1'),
             'UTF-32odd2' => array(__CLASS__, 'encodeToUTF32odd2'),
             'UTF-16BE'   => array(__CLASS__, 'encodeToUTF16BE'),
             'UTF-16LE'   => array(__CLASS__, 'encodeToUTF16LE'),
             'UTF-8'      => array(__CLASS__, 'encodeToUTF8'),
             'GB-18030'   => array(__CLASS__, 'encodeToUTF8'),
         );
     }
 
     /**
      * Binary-safe substr.
      *
      * substr() is not binary-safe; this method loops by character to ensure
      * multi-byte characters are aggregated correctly.
      *
      * @param string $string
      * @param int $start
      * @param int $end
      * @return string
      */
     protected static function substr($string, $start, $end)
     {
         $substr = '';
         for ($i = $start; $i < $end; $i += 1) {
             $substr .= $string[$i];
         }
         return $substr;
     }
 
     /**
      * Generate an entity comparison based on the given encoding.
      *
      * This patch is internal only, and public only so it can be used as a
      * callable to pass to array_map.
      *
      * @internal
      * @param string $encoding
      * @return string
      */
     public static function generateEntityComparison($encoding)
     {
         $encodingMap = self::getAsciiEncodingMap();
         $generator   = isset($encodingMap[$encoding]) ? $encodingMap[$encoding] : $encodingMap['UTF-8'];
         return call_user_func($generator, '<!ENTITY');
     }
 
     /**
      * Encode an ASCII string to UTF-32BE
      *
      * @internal
      * @param string $ascii
      * @return string
      */
     public static function encodeToUTF32BE($ascii)
     {
         return preg_replace('/(.)/', "\0\0\0\\1", $ascii);
     }
 
     /**
      * Encode an ASCII string to UTF-32LE
      *
      * @internal
      * @param string $ascii
      * @return string
      */
     public static function encodeToUTF32LE($ascii)
     {
         return preg_replace('/(.)/', "\\1\0\0\0", $ascii);
     }
 
     /**
      * Encode an ASCII string to UTF-32odd1
      *
      * @internal
      * @param string $ascii
      * @return string
      */
     public static function encodeToUTF32odd1($ascii)
     {
         return preg_replace('/(.)/', "\0\\1\0\0", $ascii);
     }
 
     /**
      * Encode an ASCII string to UTF-32odd2
      *
      * @internal
      * @param string $ascii
      * @return string
      */
     public static function encodeToUTF32odd2($ascii)
     {
         return preg_replace('/(.)/', "\0\0\\1\0", $ascii);
     }
 
     /**
      * Encode an ASCII string to UTF-16BE
      *
      * @internal
      * @param string $ascii
      * @return string
      */
     public static function encodeToUTF16BE($ascii)
     {
         return preg_replace('/(.)/', "\0\\1", $ascii);
     }
 
     /**
      * Encode an ASCII string to UTF-16LE
      *
      * @internal
      * @param string $ascii
      * @return string
      */
     public static function encodeToUTF16LE($ascii)
     {
         return preg_replace('/(.)/', "\\1\0", $ascii);
     }
 
     /**
      * Encode an ASCII string to UTF-8
      *
      * @internal
      * @param string $ascii
      * @return string
      */
     public static function encodeToUTF8($ascii)
     {
         return $ascii;
     }
 }