From: Joas Schilling <coding@schilljs.com>
Date: Wed, 12 Jul 2023 07:23:37 +0000 (+0200)
Subject: fix(apps): Fix loading info.xml file
X-Git-Tag: v26.0.4~1^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=4a21e41313a19bb019258dd96cd83de452a55125;p=nextcloud-server.git

fix(apps): Fix loading info.xml file

Ref: https://bugs.php.net/bug.php?id=62577

Signed-off-by: Joas Schilling <coding@schilljs.com>
---

diff --git a/lib/base.php b/lib/base.php
index 3cca7ab3a96..732fc55be3e 100644
--- a/lib/base.php
+++ b/lib/base.php
@@ -582,6 +582,11 @@ class OC {
 	}
 
 	public static function init(): void {
+		// prevent any XML processing from loading external entities
+		libxml_set_external_entity_loader(static function () {
+			return null;
+		});
+
 		// calculate the root directories
 		OC::$SERVERROOT = str_replace("\\", '/', substr(__DIR__, 0, -4));
 
diff --git a/lib/private/App/InfoParser.php b/lib/private/App/InfoParser.php
index c0f69e615bd..79d051fd2a1 100644
--- a/lib/private/App/InfoParser.php
+++ b/lib/private/App/InfoParser.php
@@ -31,7 +31,7 @@ namespace OC\App;
 
 use OCP\ICache;
 use function libxml_disable_entity_loader;
-use function simplexml_load_file;
+use function simplexml_load_string;
 
 class InfoParser {
 	/** @var \OCP\ICache|null */
@@ -63,10 +63,10 @@ class InfoParser {
 		libxml_use_internal_errors(true);
 		if ((PHP_VERSION_ID < 80000)) {
 			$loadEntities = libxml_disable_entity_loader(false);
-			$xml = simplexml_load_file($file);
+			$xml = simplexml_load_string(file_get_contents($file));
 			libxml_disable_entity_loader($loadEntities);
 		} else {
-			$xml = simplexml_load_file($file);
+			$xml = simplexml_load_string(file_get_contents($file));
 		}
 
 		if ($xml === false) {
diff --git a/lib/private/Installer.php b/lib/private/Installer.php
index 43c3db7c3fd..0458c14da8a 100644
--- a/lib/private/Installer.php
+++ b/lib/private/Installer.php
@@ -333,10 +333,10 @@ class Installer {
 					// Check if appinfo/info.xml has the same app ID as well
 					if ((PHP_VERSION_ID < 80000)) {
 						$loadEntities = libxml_disable_entity_loader(false);
-						$xml = simplexml_load_file($extractDir . '/' . $folders[0] . '/appinfo/info.xml');
+						$xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml'));
 						libxml_disable_entity_loader($loadEntities);
 					} else {
-						$xml = simplexml_load_file($extractDir . '/' . $folders[0] . '/appinfo/info.xml');
+						$xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml'));
 					}
 					if ((string)$xml->id !== $appId) {
 						throw new \Exception(