Skip to content

Instantly share code, notes, and snippets.

@enygma
Created August 28, 2012 03:09
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save enygma/3494587 to your computer and use it in GitHub Desktop.
Save enygma/3494587 to your computer and use it in GitHub Desktop.
checking entities in XMLReader
<?php
$r = new XMLReader();
$r->xml($post);
while ($r->read()) {
if ($r->nodeType == 10) {
$doc = $r->readOuterXML();
// see if we have any entities
preg_match_all('#<!ENTITY (.*?)>#ims',$doc,$matches);
if (!empty($matches[1])) {
foreach ($matches[1] as $match) {
$entity = explode(" ",$match);
$uri = parse_url(str_replace(
'"',
'',
$entity[count($entity)-1]
));
print_r($uri);
if ($uri['scheme'] == 'file') {
throw new \Exception('Local file inclusion!');
}
}
}
}
}
?>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment