Christian Heimes avatar Christian Heimes committed 8cd7b5e

more testing and docs for ruby and php

Comments (0)

Files changed (6)

 
   REXML::Document.entity_expansion_limit = 0
 
+libxml-ruby and hpricot don't expand entities in their default configuration.
+
 
 PHP
 ---
 
 PHP's SimpleXML API is vulnerable to quadratic entity expansion and loads
-entites from local and remote resources.
+entites from local and remote resources. The option ``LIBXML_NONET`` disables
+network access but still allows local file access. ``LIBXML_NOENT`` seems to
+have no effect on entity expansion in PHP 5.4.6.
 
 
 C# / .NET / Mono
 See http://www.python.org/psf/license for licensing details.
 
 
-Contributors
-============
+Acknowledgements
+================
 
 Brett Cannon <brett@python.org>
   review and code cleanup
 #!/usr/bin/php
 <?php
-$xml = simplexml_load_file($argv[1]);
+
+// $options = 0;
+// $options = LIBXML_NONET;
+$options = LIBXML_NOENT;
+
+$xml = simplexml_load_file($argv[1], "SimpleXMLElement", $options);
 $data = (string)$xml;
 echo strlen($data);
 echo $data;

other/ruby-hpricot.rb

+#!/usr/bin/ruby -w
+require 'hpricot'
+
+xml = File.read(ARGV[0])
+doc = Hpricot(xml)
+puts doc
+

other/ruby-libxml.rb

+#!/usr/bin/ruby -w
+require 'libxml'
+
+include LibXML
+
+class PostCallbacks
+  include XML::SaxParser::Callbacks
+
+  def on_start_element(element, attributes)
+    puts element
+  end
+end
+
+parser = XML::SaxParser.file(ARGV[0])
+parser.callbacks = PostCallbacks.new
+parser.parse
+

other/ruby-rexml.rb

+#!/usr/bin/ruby -w
+require "rexml/document"
+
+xml = File.read(ARGV[0])
+# REXML::Document.entity_expansion_limit = 1000
+xmldoc = REXML::Document.new(xml)
+data = xmldoc.root.text
+#puts data.length
+puts data

other/ruby.rb

-#!/usr/bin/ruby -w
-require "rexml/document"
-
-xml = File.read(ARGV[0])
-# REXML::Document.entity_expansion_limit = 1000
-xmldoc = REXML::Document.new(xml)
-data = xmldoc.root.text
-#puts data.length
-puts data
Tip: Filter by directory path e.g. /media app.js to search for public/media/app.js.
Tip: Use camelCasing e.g. ProjME to search for ProjectModifiedEvent.java.
Tip: Filter by extension type e.g. /repo .js to search for all .js files in the /repo directory.
Tip: Separate your search with spaces e.g. /ssh pom.xml to search for src/ssh/pom.xml.
Tip: Use ↑ and ↓ arrow keys to navigate and return to view the file.
Tip: You can also navigate files with Ctrl+j (next) and Ctrl+k (previous) and view the file with Ctrl+o.
Tip: You can also navigate files with Alt+j (next) and Alt+k (previous) and view the file with Alt+o.