XmlSecurity
in package
FinalYes
Safe XML loading for untrusted input.
- Documents with a DOCTYPE are rejected (no entity expansion, no XXE).
- No network access (LIBXML_NONET), no entity substitution (no LIBXML_NOENT).
- Size limit for the input.
- Start tags are limited in length and number of attributes: libxml2 before 2.12 checks attributes for duplicates in quadratic time.
- The number of namespace declarations in scope is limited: libxml2 before 2.12 looks up every prefix by a linear search through all declarations in scope.
- Only encodings in which the markup is ASCII (UTF-8, ISO-8859-, windows-125) and UTF-16 are accepted; UTF-7 or EBCDIC would hide the markup from these checks.
Table of Contents
Constants
- DEFAULT_MAX_BYTES : int = 10 * 1024 * 1024
- MAX_ATTRIBUTES : int = 256
- Maximum number of attributes (including namespace declarations) of a single element.
- MAX_NAMESPACES_IN_SCOPE : int = 256
- Maximum number of namespace declarations in scope at any element.
- MAX_TAG_BYTES : int = 64 * 1024
- Maximum length of a single start tag including its attributes.
Methods
- load() : DOMDocument
Constants
DEFAULT_MAX_BYTES
public
int
DEFAULT_MAX_BYTES
= 10 * 1024 * 1024
MAX_ATTRIBUTES
Maximum number of attributes (including namespace declarations) of a single element.
public
int
MAX_ATTRIBUTES
= 256
MAX_NAMESPACES_IN_SCOPE
Maximum number of namespace declarations in scope at any element.
public
int
MAX_NAMESPACES_IN_SCOPE
= 256
MAX_TAG_BYTES
Maximum length of a single start tag including its attributes.
public
int
MAX_TAG_BYTES
= 64 * 1024
Methods
load()
public
static load(string $xml[, int $maxBytes = self::DEFAULT_MAX_BYTES ]) : DOMDocument
Parameters
- $xml : string
- $maxBytes : int = self::DEFAULT_MAX_BYTES