-
-
Notifications
You must be signed in to change notification settings - Fork 230
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Load configuration even if libxml entity loader is disabled #90
Load configuration even if libxml entity loader is disabled #90
Conversation
Thanks for the PR. |
Thank you for looking into that. I adapted the test but I just moved the restoration of the state before to the end of the test. I did not want to introduce some state in the testcase just for this one test (that would be needed if it is located in the tearDown). Also I replaced the re-throwing of the exception with an assertion. Unfortunately the build is still failing but I cannot reproduce these issues on my local setup. It seems that it is triggered by a changed order of the xml attributes in the generated JUnit log files.
Since it seems only to fail for tests with PHPUNIT_VERSION='4.0.*' I guess it is related to a change to an external dependency. Though the expected format seems to match with the format mentioned in the phpunit documentation: If you can give me any pointers I will gladly try to resolve these issues. |
The error in the build is related to #91 I'm going to take a look in the failures in ~7 hours, maybe a can narrow it down. |
I was able to reproduce it locally after updating phpunit 4.0.* to the most current version
I think this behaviour is related to the changes in this commit sebastianbergmann/phpunit@7dadedf It changed the way equality between two xml strings is compared. When I updated the composer.json like this (which is one commit before the one mentioned above):
Then test I don't know exactly how to proceed from here, we could just adapt the expected output. On the other hand the order of certain xml attributes should not matter if they are contained in the same node. But this fix / issue would be more suited for the phpunit project. All of this seems not related to the current PR. Maybe you can validate it by just re-scheduling the travis build for the master? I am pretty confident that it will break as well. |
Unfortunately, you were right. |
Load configuration even if libxml entity loader is disabled
Ok now finally: thanks for the contribution, the PR got merged. Just FTR: your test could be less complex if you would just do something like } catch (\Exception $e) {
$this->fail('Could not instantiate Configuration: ' . $e->getMessage());
} or just not catch the exception. |
This PR addresses a problem which occurs if the bootstrap file contains logic which disables the libxml entity loader.
The following warning will be issued:
And the following exception will be thrown:
It would be quite inconvenient to have to bypass the composer autoloading just to handle this case manually. Therefore I just wrapped the
simplexml_load_file()
call into a block which enables the libxml entity loading temporarily and restores the setting after the xml file has been parsed.More information: http://phpsecurity.readthedocs.org/en/latest/Injection-Attacks.html#defenses-against-xml-external-entity-injection