We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent 6540d61 commit 6292442Copy full SHA for 6292442
1 file changed
tests/XML/DOMDocumentFactoryTest.php
@@ -84,6 +84,19 @@ public function testStringThatContainsDocTypeIsNotAccepted(): void
84
}
85
86
87
+ public function testStringThatContainsDocTypeIsNotAccepted2(): void
88
+ {
89
+ $xml = '<?xml version="1.0" encoding="ISO-8859-1"?>
90
+ <!DOCTYPE foo [<!ENTITY % exfiltrate SYSTEM "file://dev/random">%exfiltrate;]>
91
+ <foo>y</foo>';
92
+ $this->expectException(RuntimeException::class);
93
+ $this->expectExceptionMessage(
94
+ 'Dangerous XML detected, DOCTYPE nodes are not allowed in the XML body',
95
+ );
96
+ DOMDocumentFactory::fromString($xml);
97
+ }
98
+
99
100
public function testEmptyFileIsNotValid(): void
101
{
102
$file = 'resources/xml/domdocument_empty.xml';
0 commit comments