robrichards / xmlseclibs

A PHP library for XML Security
BSD 3-Clause "New" or "Revised" License
387 stars 181 forks source link

Remove call to file_get_contents() that doesn't even work #153

Closed jaimeperez closed 6 years ago

jaimeperez commented 6 years ago

This will never work since $arUrl will either be an array or false, as returned by the previous call to parse_url(). Since it has never worked, it is obviously something we don't need.

Should we choose to fix the bug instead of removing the line, we could open for all kinds of issues (denial of service, local file inclusion, remote file inclusion, etc), so fixing it is much more complicated than just changing the variable passed to file_get_contents().