Page MenuHomePhabricator

Disable XML entity loader by default in libphutil
ClosedPublic

Authored by epriestley on Jan 23 2014, 9:32 PM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Jan 23, 4:24 AM
Unknown Object (File)
Tue, Jan 21, 7:09 PM
Unknown Object (File)
Sun, Jan 12, 9:49 PM
Unknown Object (File)
Sat, Jan 4, 5:39 PM
Unknown Object (File)
Thu, Jan 2, 11:06 PM
Unknown Object (File)
Dec 17 2024, 12:31 PM
Unknown Object (File)
Dec 17 2024, 12:31 PM
Unknown Object (File)
Dec 17 2024, 12:29 PM
Subscribers

Details

Summary

See https://www.facebook.com/BugBounty/posts/778897822124446 and http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution.

By default, SimpleXMLElement will pretty much just run whatever code you want when handed a specially crafted document. We currently load XML only from trusted (S3, EC2, git/svn/hg) or local sources (unit test runners) so there are no concrete vulnerabilities in Phabricator, but this behavior is incredibly dangerous, surprising, and highly undesirable.

Test Plan

There's an example of a document which does bad things on http://www.php.net/manual/en/function.libxml-disable-entity-loader.php. I verified that SimpleXMLElement reads /etc/passwd when handed this document, then applied the fix. It no longer reads arbitrary files off disk.

Diff Detail

Branch
xmlent
Lint
Lint Errors
SeverityLocationCodeMessage
Errorscripts/__init_script__.php:64XHP31Use Of PHP 5.3 Features
Unit
No Test Coverage