{"action":"created","issue":{"url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/241","labels_url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/241/labels{/name}","comments_url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/241/comments","events_url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/241/events","html_url":"https://github.com/simplesamlphp/simplesamlphp/issues/241","id":101743673,"number":241,"title":"libxml_disable_entity_loader status must be restored to previous value","user":{"login":"sgomez","id":580701,"avatar_url":"https://avatars.githubusercontent.com/u/580701?v=3","gravatar_id":"","url":"https://api.github.com/users/sgomez","html_url":"https://github.com/sgomez","followers_url":"https://api.github.com/users/sgomez/followers","following_url":"https://api.github.com/users/sgomez/following{/other_user}","gists_url":"https://api.github.com/users/sgomez/gists{/gist_id}","starred_url":"https://api.github.com/users/sgomez/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sgomez/subscriptions","organizations_url":"https://api.github.com/users/sgomez/orgs","repos_url":"https://api.github.com/users/sgomez/repos","events_url":"https://api.github.com/users/sgomez/events{/privacy}","received_events_url":"https://api.github.com/users/sgomez/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/labels/bug","name":"bug","color":"eb6420"},{"url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/labels/medium","name":"medium","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-08-18T20:39:20Z","updated_at":"2015-08-28T09:33:03Z","closed_at":null,"body":"At the end of _/www/_include.php_ we can found this:\r\n\r\n```php\r\n// disable XML external entity loading explicitly\r\nlibxml_disable_entity_loader();\r\n```\r\n\r\nBut this function has a bug (or a feature, I don't know): https://bugs.php.net/bug.php?id=64938\r\nThe configuration is shared between threads, so when this function is called, the entity loader is disabled for all php threads forever (or until php-fpm restarts). The problem is the default value is false and not true, so it could cause problems with  applications than interact with simplesamlphp and expects the default value (Symfony and FOSUserBundle in my case).\r\n\r\nThe polite way should be deactivate and restore the previous value every time than we process a XML file:\r\n\r\n```php\r\n$previous = libxml_disable_entity_loader(true);\r\n// Some XML stuff\r\nlibxml_disable_entity_loader($previous)\r\n```\r\n\r\nBut I guess that this requires some work. I'd like to help but I don't want to work in this without know if the push will be accepted in the first place."},"comment":{"url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/comments/135713923","html_url":"https://github.com/simplesamlphp/simplesamlphp/issues/241#issuecomment-135713923","issue_url":"https://api.github.com/repos/simplesamlphp/simplesamlphp/issues/241","id":135713923,"user":{"login":"thijskh","id":3808792,"avatar_url":"https://avatars.githubusercontent.com/u/3808792?v=3","gravatar_id":"","url":"https://api.github.com/users/thijskh","html_url":"https://github.com/thijskh","followers_url":"https://api.github.com/users/thijskh/followers","following_url":"https://api.github.com/users/thijskh/following{/other_user}","gists_url":"https://api.github.com/users/thijskh/gists{/gist_id}","starred_url":"https://api.github.com/users/thijskh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thijskh/subscriptions","organizations_url":"https://api.github.com/users/thijskh/orgs","repos_url":"https://api.github.com/users/thijskh/repos","events_url":"https://api.github.com/users/thijskh/events{/privacy}","received_events_url":"https://api.github.com/users/thijskh/received_events","type":"User","site_admin":false},"created_at":"2015-08-28T09:33:03Z","updated_at":"2015-08-28T09:33:03Z","body":"Yes, that seems like a good approach."}}