API reference / Quittio \ Core \ Xml
XmlSecurity
final class in quittio/core
Quittio\Core\Xml\XmlSecurity · Source
Safe XML loading for untrusted input.
- Documents with a DOCTYPE are rejected (no entity expansion, no XXE).
- No network access (LIBXML_NONET), no entity substitution (no LIBXML_NOENT).
- Size limit for the input.
- Start tags are limited in length and number of attributes: libxml2 before 2.12 checks attributes for duplicates in quadratic time.
- The number of namespace declarations in scope is limited: libxml2 before 2.12 looks up every prefix by a linear search through all declarations in scope.
- Only encodings in which the markup is ASCII (UTF-8, ISO-8859-, windows-125) and UTF-16 are accepted; UTF-7 or EBCDIC would hide the markup from these checks.
Constants#
| Constant | Value | Description |
|---|---|---|
DEFAULT_MAX_BYTES | 10 * 1024 * 1024 | |
MAX_ATTRIBUTES | 256 | Maximum number of attributes (including namespace declarations) of a single element. |
MAX_NAMESPACES_IN_SCOPE | 256 | Maximum number of namespace declarations in scope at any element. |
MAX_TAG_BYTES | 64 * 1024 | Maximum length of a single start tag including its attributes. |
Methods#
| Method | Description |
|---|---|
::load() |
load()#
public static function load(
string $xml,
int $maxBytes = self::DEFAULT_MAX_BYTES,
): DOMDocument| Parameter | Type | Description |
|---|---|---|
$xml | string | |
$maxBytes | int = self::DEFAULT_MAX_BYTES |
- Returns
DOMDocument