geckon01/php-curl-class
1
0
Fork 0
mirror of https://github.com/php-curl-class/php-curl-class.git synced 2026-08-27 18:50:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add XML external entity injection section to security doc

Browse Source
This commit is contained in:
Zach Borboa
2018-06-20 03:03:25 -07:00
committed by GitHub
parent eca70c8d41
commit 7ba91bd554
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+8
View File
@@ -84,3 +84,11 @@ $curl->get('https://www.example.com/image.png');
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // DANGER!
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // DANGER!
```
### Prevent XML External Entity injection
* Set the following when using the default PHP XML parser to prevent XML external entity injection.
```php
libxml_disable_entity_loader(true);
```