{"action":"opened","issue":{"url":"https://api.github.com/repos/onelogin/php-saml/issues/55","labels_url":"https://api.github.com/repos/onelogin/php-saml/issues/55/labels{/name}","comments_url":"https://api.github.com/repos/onelogin/php-saml/issues/55/comments","events_url":"https://api.github.com/repos/onelogin/php-saml/issues/55/events","html_url":"https://github.com/onelogin/php-saml/issues/55","id":57045213,"number":55,"title":"loadXML checking EXXE/XEE attack failing","user":{"login":"zot24","id":678498,"avatar_url":"https://avatars.githubusercontent.com/u/678498?v=3","gravatar_id":"","url":"https://api.github.com/users/zot24","html_url":"https://github.com/zot24","followers_url":"https://api.github.com/users/zot24/followers","following_url":"https://api.github.com/users/zot24/following{/other_user}","gists_url":"https://api.github.com/users/zot24/gists{/gist_id}","starred_url":"https://api.github.com/users/zot24/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zot24/subscriptions","organizations_url":"https://api.github.com/users/zot24/orgs","repos_url":"https://api.github.com/users/zot24/repos","events_url":"https://api.github.com/users/zot24/events{/privacy}","received_events_url":"https://api.github.com/users/zot24/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-09T15:29:31Z","updated_at":"2015-02-09T15:29:31Z","closed_at":null,"body":"On this line: [Utils.php#L53](https://github.com/onelogin/php-saml/blob/master/lib/Saml2/Utils.php#L53) you are checking for an `ENTITY` node using `strpos` \r\n\r\nOn [PHP documentation](http://php.net/strpos) you could read:\r\n\r\n>Warning: This function may return Boolean FALSE, but may also return a non-Boolean value which evaluates to FALSE. Please read the section on Booleans for more information. Use the === operator for testing the return value of this function.\r\n\r\nIn my case the expression:\r\n\r\n```\r\nstrpos($xml, '<!ENTITY')\r\n```\r\n\r\nIs returning `NULL` so your logic:\r\n\r\n```\r\nif (strpos($xml, '<!ENTITY') !== false) {\r\n       throw new Exception('Detected use of ENTITY in XML, disabled to prevent XXE/XEE attacks');\r\n}\r\n```\r\n\r\nIs always throwing that `Exception` wouldn't be better if the condition check the expression below instead?\r\n\r\n```\r\nif (strpos($xml, '<!ENTITY')) {\r\n       throw new Exception('Detected use of ENTITY in XML, disabled to prevent XXE/XEE attacks');\r\n}\r\n```\r\n\r\n"}}