修复微信官方发布的XML外部实体注入漏洞

Author: mengwb

Wechat/Lib/Tools.php

@@ -137,7 +137,10 @@ static private function _data_to_xml($data, $item = 'item', $id = 'id', $content
      */
     static public function xml2arr($xml)
     {
-        return json_decode(Tools::json_encode(simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOCDATA)), true);
+        $disableEntities = libxml_disable_entity_loader(true);
+        $result = json_decode(Tools::json_encode(simplexml_load_string($xml, 'SimpleXMLElement', LIBXML_NOCDATA)), true);
+        libxml_disable_entity_loader($disableEntities);
+        return $result;
     }
 
     /**

Wechat/WechatPay.php

@@ -208,7 +208,9 @@ public function createMicroPay($auth_code, $out_trade_no, $total_fee, $body, $go
      */
     public function getNotify()
     {
+        $disableEntities = libxml_disable_entity_loader(true);
         $notifyInfo = (array)simplexml_load_string(file_get_contents("php://input"), 'SimpleXMLElement', LIBXML_NOCDATA);
+        libxml_disable_entity_loader($disableEntities);
         if (empty($notifyInfo)) {
             Tools::log('Payment notification forbidden access.', "ERR - {$this->appid}");
             $this->errCode = '404';