Merge branch 'hotfix/xee'

src/Reader/Reader.php

@@ -269,10 +269,17 @@ public static function import($uri, $etag = null, $lastModified = null)
     public static function importString($string)
     {
         $libxml_errflag = libxml_use_internal_errors(true);
-        libxml_disable_entity_loader(true);
+        $oldValue = libxml_disable_entity_loader(true);
         $dom = new DOMDocument;
         $status = $dom->loadXML(trim($string));
-        libxml_disable_entity_loader(false);
+        foreach ($dom->childNodes as $child) {
+            if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
+                throw new Exception\InvalidArgumentException(
+                    'Invalid XML: Detected use of illegal DOCTYPE'
+                );
+            }
+        }
+        libxml_disable_entity_loader($oldValue);
         libxml_use_internal_errors($libxml_errflag);
 
         if (!$status) {
@@ -339,10 +346,10 @@ public static function findFeedLinks($uri)
         }
         $responseHtml = $response->getBody();
         $libxml_errflag = libxml_use_internal_errors(true);
-        libxml_disable_entity_loader(true);
+        $oldValue = libxml_disable_entity_loader(true);
         $dom = new DOMDocument;
         $status = $dom->loadHTML(trim($responseHtml));
-        libxml_disable_entity_loader(false);
+        libxml_disable_entity_loader($oldValue);
         libxml_use_internal_errors($libxml_errflag);
         if (!$status) {
             // Build error message
@@ -377,10 +384,17 @@ public static function detectType($feed, $specOnly = false)
         } elseif (is_string($feed) && !empty($feed)) {
             ErrorHandler::start(E_NOTICE|E_WARNING);
             ini_set('track_errors', 1);
-            libxml_disable_entity_loader(true);
+            $oldValue = libxml_disable_entity_loader(true);
             $dom = new DOMDocument;
             $status = $dom->loadXML($feed);
-            libxml_disable_entity_loader(false);
+            foreach ($dom->childNodes as $child) {
+                if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
+                    throw new Exception\InvalidArgumentException(
+                        'Invalid XML: Detected use of illegal DOCTYPE'
+                    );
+                }
+            }
+            libxml_disable_entity_loader($oldValue);
             ini_restore('track_errors');
             ErrorHandler::stop();
             if (!$status) {

test/Reader/ReaderTest.php

@@ -270,10 +270,11 @@ public function testRegistersUserExtension()
 
     public function testXxePreventionOnFeedParsing()
     {
+        $this->setExpectedException('Zend\Feed\Reader\Exception\InvalidArgumentException');
         $string = file_get_contents($this->_feedSamplePath.'/Reader/xxe-atom10.xml');
         $string = str_replace('XXE_URI', $this->_feedSamplePath.'/Reader/xxe-info.txt', $string);
         $feed = Reader\Reader::importString($string);
-        $this->assertEquals('info:', $feed->getTitle());
+        //$this->assertEquals('info:', $feed->getTitle());
     }
 
     protected function _getTempDirectory()