From 7ba91bd554d619746bb5e283505c8b84668887e8 Mon Sep 17 00:00:00 2001 From: Zach Borboa Date: Wed, 20 Jun 2018 03:03:25 -0700 Subject: [PATCH] Add XML external entity injection section to security doc --- SECURITY.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index 12d5553..39af527 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -84,3 +84,11 @@ $curl->get('https://www.example.com/image.png'); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // DANGER! curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // DANGER! ``` + +### Prevent XML External Entity injection + +* Set the following when using the default PHP XML parser to prevent XML external entity injection. + +```php +libxml_disable_entity_loader(true); +```