From 56cc7dfb5140620c6620156422c1f06cc802c973 Mon Sep 17 00:00:00 2001 From: Ikram Shaik Date: Thu, 10 Sep 2026 18:26:16 +0530 Subject: [PATCH] Fix #505: Remove @ suppressors from libxml_disable_entity_loader() and add LIBXML_NOENT - Remove @ error suppression on libxml_disable_entity_loader() calls in XML2array() so failures are not silently ignored on PHP < 8.0 - Add explicit check: if disabling entity loading fails, return false instead of proceeding with XXE enabled - Add LIBXML_NOENT to GETID3_LIBXML_OPTIONS as defence-in-depth to explicitly disable external entity substitution at the parser level Ref: CWE-611, https://github.com/JamesHeinrich/getID3/issues/505 --- getid3/getid3.lib.php | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/getid3/getid3.lib.php b/getid3/getid3.lib.php index 911876ee..08450ce4 100644 --- a/getid3/getid3.lib.php +++ b/getid3/getid3.lib.php @@ -13,9 +13,9 @@ if (!defined('GETID3_LIBXML_OPTIONS') && defined('LIBXML_VERSION')) { if (LIBXML_VERSION >= 20621) { - define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOWARNING | LIBXML_COMPACT); + define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOENT | LIBXML_NOWARNING | LIBXML_COMPACT); } else { - define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOWARNING); + define('GETID3_LIBXML_OPTIONS', LIBXML_NONET | LIBXML_NOENT | LIBXML_NOWARNING); } } @@ -746,10 +746,14 @@ public static function XML2array($XMLstring) { // https://core.trac.wordpress.org/changeset/29378 // This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is // disabled by default, but is still needed when LIBXML_NOENT is used. - $loader = @libxml_disable_entity_loader(true); + $loader = libxml_disable_entity_loader(true); + if ($loader === false && !libxml_disable_entity_loader(true)) { + // Failed to disable external entity loading — refuse to parse to prevent XXE + return false; + } $XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', GETID3_LIBXML_OPTIONS); $return = self::SimpleXMLelement2array($XMLobject); - @libxml_disable_entity_loader($loader); + libxml_disable_entity_loader($loader); return $return; } } else {