PHP - Manual: libxml_set_external_entity_loader
2024-12-25
(PHP 5 >= 5.4.0, PHP 7, PHP 8)
libxml_set_external_entity_loader — Changes the default external entity loader
Changes the default external entity loader.
This can be used to suppress the expansion of arbitrary external entities to avoid XXE attacks,
even when LIBXML_NOENT
has been set for the respective operation,
and is usually preferable over calling libxml_disable_entity_loader().
resolver_function
A callable with the following signature:
$public_id
, string $system_id
, array $context
): resource|string|nullpublic_id
system_id
context
"directory"
, "intSubName"
,
"extSubURI"
and "extSubSystem"
.
null
is returned, the entity reference resolution will fail.
成功时返回 true
, 或者在失败时返回 false
。
示例 #1 libxml_set_external_entity_loader() example
<?php
$xml = <<<XML
<!DOCTYPE foo PUBLIC "-//FOO/BAR" "http://example.com/foobar">
<foo>bar</foo>
XML;
$dtd = <<<DTD
<!ELEMENT foo (#PCDATA)>
DTD;
libxml_set_external_entity_loader(
function ($public, $system, $context) use($dtd) {
var_dump($public);
var_dump($system);
var_dump($context);
$f = fopen("php://temp", "r+");
fwrite($f, $dtd);
rewind($f);
return $f;
}
);
$dd = new DOMDocument;
$r = $dd->loadXML($xml);
var_dump($dd->validate());
?>
以上例程会输出:
string(10) "-//FOO/BAR" string(25) "http://example.com/foobar" array(4) { ["directory"] => NULL ["intSubName"] => NULL ["extSubURI"] => NULL ["extSubSystem"] => NULL } bool(true)
官方地址:https://www.php.net/manual/en/function.libxml-set-external-entity-loader.php