Skip to content

Commit e5c5878

Browse files
tmotyltmotyl
committed
SUPEE-3762 Prevent showing install page after refresing SOAP index
Prevents repeated SOAP index page call issue from causing customers to only see the Magento installation page Refreshing the SOAP v2 index page (http://your-magento-host-name/index.php/api/v2_soap/index/) results in all administrators and customers viewing the Magento installation page.
1 parent 5345da5 commit e5c5878

File tree

3 files changed

+214
-11
lines changed

3 files changed

+214
-11
lines changed

‎lib/Zend/Soap/Server.php‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,12 @@
2424
*/
2525
#require_once 'Zend/Server/Interface.php';
2626

27+
/** @see Zend_Xml_Security */
28+
#require_once 'Zend/Xml/Security.php';
29+
30+
/** @see Zend_Xml_Exception */
31+
#require_once 'Zend/Xml/Exception.php';
32+
2733
/**
2834
* Zend_Soap_Server
2935
*
@@ -729,21 +735,18 @@ protected function _setRequest($request)
729735
$xml = $request;
730736
}
731737

732-
libxml_disable_entity_loader(true);
733738
$dom = new DOMDocument();
734-
if(strlen($xml) == 0 || !$dom->loadXML($xml)) {
735-
#require_once 'Zend/Soap/Server/Exception.php';
736-
throw new Zend_Soap_Server_Exception('Invalid XML');
737-
}
738-
foreach ($dom->childNodes as $child) {
739-
if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
739+
try {
740+
if(strlen($xml) == 0 || (!$dom = Zend_Xml_Security::scan($xml, $dom))) {
740741
#require_once 'Zend/Soap/Server/Exception.php';
741-
throw new Zend_Soap_Server_Exception(
742-
'Invalid XML: Detected use of illegal DOCTYPE'
743-
);
742+
throw new Zend_Soap_Server_Exception('Invalid XML');
744743
}
744+
} catch (Zend_Xml_Exception $e) {
745+
#require_once 'Zend/Soap/Server/Exception.php';
746+
throw new Zend_Soap_Server_Exception(
747+
$e->getMessage()
748+
);
745749
}
746-
libxml_disable_entity_loader(false);
747750
}
748751
$this->_request = $xml;
749752
return $this;

‎lib/Zend/Xml/Exception.php‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<?php
2+
/**
3+
* Zend Framework
4+
*
5+
* LICENSE
6+
*
7+
* This source file is subject to the new BSD license that is bundled
8+
* with this package in the file LICENSE.txt.
9+
* It is also available through the world-wide-web at this URL:
10+
* http://framework.zend.com/license/new-bsd
11+
* If you did not receive a copy of the license and are unable to
12+
* obtain it through the world-wide-web, please send an email
13+
* to [email protected] so we can send you a copy immediately.
14+
*
15+
* @category Zend
16+
* @package Zend_Xml
17+
* @copyright Copyright (c) 2005-2014 Zend Technologies USA Inc. (http://www.zend.com)
18+
* @license http://framework.zend.com/license/new-bsd New BSD License
19+
* @version $Id$
20+
*/
21+
22+
23+
/**
24+
* @see Zend_Exception
25+
*/
26+
#require_once 'Zend/Exception.php';
27+
28+
29+
/**
30+
* @category Zend
31+
* @package Zend_Xml
32+
* @copyright Copyright (c) 2005-2014 Zend Technologies USA Inc. (http://www.zend.com)
33+
* @license http://framework.zend.com/license/new-bsd New BSD License
34+
*/
35+
class Zend_Xml_Exception extends Zend_Exception
36+
{}

‎lib/Zend/Xml/Security.php‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
<?php
2+
/**
3+
* Zend Framework
4+
*
5+
* LICENSE
6+
*
7+
* This source file is subject to the new BSD license that is bundled
8+
* with this package in the file LICENSE.txt.
9+
* It is also available through the world-wide-web at this URL:
10+
* http://framework.zend.com/license/new-bsd
11+
* If you did not receive a copy of the license and are unable to
12+
* obtain it through the world-wide-web, please send an email
13+
* to [email protected] so we can send you a copy immediately.
14+
*
15+
* @category Zend
16+
* @package Zend_Xml
17+
* @copyright Copyright (c) 2005-2014 Zend Technologies USA Inc. (http://www.zend.com)
18+
* @license http://framework.zend.com/license/new-bsd New BSD License
19+
* @version $Id$
20+
*/
21+
22+
23+
/**
24+
* @category Zend
25+
* @package Zend_Xml_SecurityScan
26+
* @copyright Copyright (c) 2005-2014 Zend Technologies USA Inc. (http://www.zend.com)
27+
* @license http://framework.zend.com/license/new-bsd New BSD License
28+
*/
29+
class Zend_Xml_Security
30+
{
31+
const ENTITY_DETECT = 'Detected use of ENTITY in XML, disabled to prevent XXE/XEE attacks';
32+
33+
/**
34+
* Heuristic scan to detect entity in XML
35+
*
36+
* @param string $xml
37+
* @throws Zend_Xml_Exception
38+
*/
39+
protected static function heuristicScan($xml)
40+
{
41+
if (strpos($xml, '<!ENTITY') !== false) {
42+
#require_once 'Exception.php';
43+
throw new Zend_Xml_Exception(self::ENTITY_DETECT);
44+
}
45+
}
46+
47+
/**
48+
* @param integer $errno
49+
* @param string $errstr
50+
* @param string $errfile
51+
* @param integer $errline
52+
* @return bool
53+
*/
54+
public static function loadXmlErrorHandler($errno, $errstr, $errfile, $errline)
55+
{
56+
if (substr_count($errstr, 'DOMDocument::loadXML()') > 0) {
57+
return true;
58+
}
59+
return false;
60+
}
61+
62+
/**
63+
* Scan XML string for potential XXE and XEE attacks
64+
*
65+
* @param string $xml
66+
* @param DomDocument $dom
67+
* @throws Zend_Xml_Exception
68+
* @return SimpleXMLElement|DomDocument|boolean
69+
*/
70+
public static function scan($xml, DOMDocument $dom = null)
71+
{
72+
// If running with PHP-FPM we perform an heuristic scan
73+
// We cannot use libxml_disable_entity_loader because of this bug
74+
// @see https://bugs.php.net/bug.php?id=64938
75+
if (self::isPhpFpm()) {
76+
self::heuristicScan($xml);
77+
}
78+
79+
if (null === $dom) {
80+
$simpleXml = true;
81+
$dom = new DOMDocument();
82+
}
83+
84+
if (!self::isPhpFpm()) {
85+
$loadEntities = libxml_disable_entity_loader(true);
86+
$useInternalXmlErrors = libxml_use_internal_errors(true);
87+
}
88+
89+
// Load XML with network access disabled (LIBXML_NONET)
90+
// error disabled with @ for PHP-FPM scenario
91+
set_error_handler(array('Zend_Xml_Security', 'loadXmlErrorHandler'), E_WARNING);
92+
93+
$result = $dom->loadXml($xml, LIBXML_NONET);
94+
restore_error_handler();
95+
96+
if (!$result) {
97+
// Entity load to previous setting
98+
if (!self::isPhpFpm()) {
99+
libxml_disable_entity_loader($loadEntities);
100+
libxml_use_internal_errors($useInternalXmlErrors);
101+
}
102+
return false;
103+
}
104+
105+
// Scan for potential XEE attacks using ENTITY, if not PHP-FPM
106+
if (!self::isPhpFpm()) {
107+
foreach ($dom->childNodes as $child) {
108+
if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
109+
if ($child->entities->length > 0) {
110+
#require_once 'Exception.php';
111+
throw new Zend_Xml_Exception(self::ENTITY_DETECT);
112+
}
113+
}
114+
}
115+
}
116+
117+
// Entity load to previous setting
118+
if (!self::isPhpFpm()) {
119+
libxml_disable_entity_loader($loadEntities);
120+
libxml_use_internal_errors($useInternalXmlErrors);
121+
}
122+
123+
if (isset($simpleXml)) {
124+
$result = simplexml_import_dom($dom);
125+
if (!$result instanceof SimpleXMLElement) {
126+
return false;
127+
}
128+
return $result;
129+
}
130+
return $dom;
131+
}
132+
133+
/**
134+
* Scan XML file for potential XXE/XEE attacks
135+
*
136+
* @param string $file
137+
* @param DOMDocument $dom
138+
* @throws Zend_Xml_Exception
139+
* @return SimpleXMLElement|DomDocument
140+
*/
141+
public static function scanFile($file, DOMDocument $dom = null)
142+
{
143+
if (!file_exists($file)) {
144+
#require_once 'Exception.php';
145+
throw new Zend_Xml_Exception(
146+
"The file $file specified doesn't exist"
147+
);
148+
}
149+
return self::scan(file_get_contents($file), $dom);
150+
}
151+
152+
/**
153+
* Return true if PHP is running with PHP-FPM
154+
*
155+
* @return boolean
156+
*/
157+
public static function isPhpFpm()
158+
{
159+
if (substr(php_sapi_name(), 0, 3) === 'fpm') {
160+
return true;
161+
}
162+
return false;
163+
}
164+
}

0 commit comments

Comments
 (0)