simplesamlphp / saml2

SimpleSAMLphp low-level SAML2 PHP library
https://www.simplesamlphp.org
GNU Lesser General Public License v2.1
284 stars 135 forks source link

PHP 8.0 support and `libxml_disable_entity_loader` #283

Closed ldebrouwer closed 3 years ago

ldebrouwer commented 3 years ago

In PHP 8.0 libxml_disable_entity_loader has been deprecated, and it throws a warning going forward. To support PHP 8.0 on the ^4.2.2 branch, as suggested by the composer.json, the calls to libxml_disable_entity_loader in DOMDocumentFactory::fromString() should be wrapped in version check, like so;

if (\PHP_VERSION_ID < 80000) {
    libxml_disable_entity_loader($entityLoader);
}
thijskh commented 3 years ago

For the record, this is safe because PHP8 depends on a version of libxml that has external entities disabled.

It might be a good idea though, given the risk, to add a test for this so we ensure it is in fact disabled.

tvdijen commented 3 years ago

Closed in 04d0ed6c5e51cbb328afe1bdcba2cc7bd84d7e87 (v4.2.3). Thanks @ldebrouwer !