CVE-2015-10029: Improper Restriction of XML External Entity Reference (CWE-611)
value: A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipulation leads to xml external entity reference. Upgrading to version 3.1.1 is able to address this issue. The patch is identified as 4c9f2e028523ed705b555eca2c18c64e71f1a35d. It is recommended to upgrade the affected component. VDB-217630 is the identifier assigned to this vulnerability.
CWE description: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CVSS v3 base score: 9.8
Published: 2023-01-07T20:15Z
Repository: https://github.com/kelvinmo/simplexrd
Language: PHP
Files changed: CHANGELOG.md, simplexrd/simplexrd.class.php
Commit date: 2015-10-24 12:32:09 +1100
Commit message: Changed XML loading code to prevent XML external entity processing attacks

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index ba7a471..654e04f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
+## 3.1.1
+
+- Changed XML loading code to prevent XML external entity processing attacks
+
 ## 3.1
 
 - Added [Travis CI](https://travis-ci.org/) configuration
 
 ## 3.0
diff --git a/simplexrd/simplexrd.class.php b/simplexrd/simplexrd.class.php
index c4f0f1c..45b8511 100644
--- a/simplexrd/simplexrd.class.php
+++ b/simplexrd/simplexrd.class.php
@@ -66,11 +66,11 @@ class SimpleXRD {
     /**
      * XML reader
      * @var resource
      */
     private $reader;
-    
+
     /**
      * XML namespace constant
      * @var string
      */
     private $XML_NS = 'http://www.w3.org/XML/1998/namespace';
@@ -78,20 +78,20 @@ class SimpleXRD {
     /**
      * JRD equivalent document
      * @var array
      */
     private $jrd = array();
-    
+
     /**
      * Creates an instance of the XRD parser.
      *
      * This constructor also initialises the underlying XML parser.
      */
     public function __construct() {
         $this->reader = new XMLReader();
     }
-    
+
     /**
      * Frees memory associated with the underlying XML parser.
      *
      * Note that only the memory associated with the underlying XML parser is
      * freed.  Memory associated with the class itself is not freed.
@@ -105,13 +105,13 @@ class SimpleXRD {
      * Loads an XRD document.
      *
      * @param string $xml the XML document to load
      */
     public function load($xml) {
-        $this->reader->xml($xml);
+        $this->reader->xml($xml, null, LIBXML_NONET);
     }
-    
+
     /**
      * Parses the loaded XRD document and returns the JRD-equivalent structure.
      *
      * The $include_expires parameter determines whether the Expires element should
      * be parsed.  Under the original host-meta JRD RFC 6415, the Expires element is
@@ -120,16 +120,16 @@ class SimpleXRD {
      *
      * @param bool $include_expires whether the Expires element should be parsed
      * @return array the JRD equivalent structure
      */
     public function parse($include_expires = false) {
-        while ($this->reader->read()) {            
-            if (($this->reader->nodeType == XMLReader::ELEMENT) 
+        while ($this->reader->read()) {
+            if (($this->reader->nodeType == XMLReader::ELEMENT)
                 && ($this->reader->namespaceURI == self::XRD_NS)) {
                 switch ($this->reader->localName) {
                     case 'XRD':
-                        $this->jrd = array();                        
+                        $this->jrd = array();
                         break;
                     case 'Expires':
                         if ($include_expires) $this->jrd['expires'] = $this->reader->readString();
                         break;
                     case 'Subject':
@@ -146,11 +146,11 @@ class SimpleXRD {
                     case 'Property':
                         if (!isset($this->jrd['properties'])) $this->jrd['properties'] = array();
                         $this->parseProperty($this->jrd['properties']);
                         break;
                 }
-            
+
             }
         }
         return $this->jrd;
     }
 
@@ -175,11 +175,11 @@ class SimpleXRD {
             if (($this->reader->nodeType == XMLReader::END_ELEMENT) &&
                 ($this->reader->namespaceURI == self::XRD_NS) &&
                 ($this->reader->localName == 'Link'))
                 break;
 
-            if (($this->reader->nodeType == XMLReader::ELEMENT) 
+            if (($this->reader->nodeType == XMLReader::ELEMENT)
                 && ($this->reader->namespaceURI == self::XRD_NS)) {
                 switch ($this->reader->localName) {
                     case 'Property':
                         if (!isset($link['properties'])) $link['properties'] = array();
                         $this->parseProperty($link['properties']);

Vulnerable code:     
    
    
        $this->reader->xml($xml);
    
        while ($this->reader->read()) {            
            if (($this->reader->nodeType == XMLReader::ELEMENT) 
                        $this->jrd = array();                        
            
            if (($this->reader->nodeType == XMLReader::ELEMENT) 
Fixed code: ## 3.1.1

- Changed XML loading code to prevent XML external entity processing attacks




        $this->reader->xml($xml, null, LIBXML_NONET);

        while ($this->reader->read()) {
            if (($this->reader->nodeType == XMLReader::ELEMENT)
                        $this->jrd = array();

            if (($this->reader->nodeType == XMLReader::ELEMENT)