Merge pull request #39495 from nextcloud/backport/39490/stable23

[stable23] fix(apps): Fix loading info.xml file
nextcloud · Jul 20, 2023 · ad4ef1c · ad4ef1c
2 parents 1c0accf + 56a23ce
commit ad4ef1c
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 5 deletions.
diff --git a/lib/base.php b/lib/base.php
@@ -551,6 +551,11 @@ private static function performSameSiteCookieProtection(\OCP\IConfig $config) {
 	}
 
 	public static function init() {
+		// prevent any XML processing from loading external entities
+		libxml_set_external_entity_loader(static function () {
+			return null;
+		});
+
 		// calculate the root directories
 		OC::$SERVERROOT = str_replace("\\", '/', substr(__DIR__, 0, -4));
 

diff --git a/lib/private/App/InfoParser.php b/lib/private/App/InfoParser.php
@@ -31,7 +31,7 @@
 
 use OCP\ICache;
 use function libxml_disable_entity_loader;
-use function simplexml_load_file;
+use function simplexml_load_string;
 
 class InfoParser {
 	/** @var \OCP\ICache|null */
@@ -63,10 +63,10 @@ public function parse($file) {
 		libxml_use_internal_errors(true);
 		if ((PHP_VERSION_ID < 80000)) {
 			$loadEntities = libxml_disable_entity_loader(false);
-			$xml = simplexml_load_file($file);
+			$xml = simplexml_load_string(file_get_contents($file));
 			libxml_disable_entity_loader($loadEntities);
 		} else {
-			$xml = simplexml_load_file($file);
+			$xml = simplexml_load_string(file_get_contents($file));
 		}
 
 		if ($xml === false) {

diff --git a/lib/private/Installer.php b/lib/private/Installer.php
@@ -335,10 +335,10 @@ public function downloadApp($appId, $allowUnstable = false) {
 						// Check if appinfo/info.xml has the same app ID as well
 						if ((PHP_VERSION_ID < 80000)) {
 							$loadEntities = libxml_disable_entity_loader(false);
-							$xml = simplexml_load_file($extractDir . '/' . $folders[0] . '/appinfo/info.xml');
+							$xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml'));
 							libxml_disable_entity_loader($loadEntities);
 						} else {
-							$xml = simplexml_load_file($extractDir . '/' . $folders[0] . '/appinfo/info.xml');
+							$xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml'));
 						}
 						if ((string)$xml->id !== $appId) {
 							throw new \Exception(