From ebb815eb75cbc7f487702714eb094f7e2176d4f9 Mon Sep 17 00:00:00 2001 From: 77web Date: Sun, 20 Sep 2026 14:33:40 +0900 Subject: [PATCH] applied fixes in upstream https://github.com/kamilwylegala/cakephp2-php8/pull/87: Fix readFile bypass for https urls in Xml::build() --- lib/Cake/Test/Case/Utility/XmlTest.php | 11 +++++++++++ lib/Cake/Utility/Xml.php | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/lib/Cake/Test/Case/Utility/XmlTest.php b/lib/Cake/Test/Case/Utility/XmlTest.php index 8fa7fd9ef5..1aacb51fcf 100644 --- a/lib/Cake/Test/Case/Utility/XmlTest.php +++ b/lib/Cake/Test/Case/Utility/XmlTest.php @@ -201,6 +201,17 @@ public function testBuildFromUrlWhenDisabled() { Xml::build($xml, array('readFile' => false)); } +/** + * Test that the readFile option disables https url parsing too. + * + * @return void + */ + public function testBuildFromHttpsUrlWhenDisabled() { + $this->expectException(XmlException::class); + $xml = 'https://www.google.com'; + Xml::build($xml, array('readFile' => false)); + } + /** * data provider function for testBuildInvalidData * diff --git a/lib/Cake/Utility/Xml.php b/lib/Cake/Utility/Xml.php index 84a67ea5d9..33f93f944b 100644 --- a/lib/Cake/Utility/Xml.php +++ b/lib/Cake/Utility/Xml.php @@ -107,7 +107,7 @@ public static function build($input, $options = array()) { return static::_loadXml($input, $options); } elseif ($options['readFile'] && file_exists($input)) { return static::_loadXml(file_get_contents($input), $options); - } elseif ($options['readFile'] && strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0) { + } elseif ($options['readFile'] && (strpos($input, 'http://') === 0 || strpos($input, 'https://') === 0)) { try { $socket = new HttpSocket(array('request' => array('redirect' => 10))); $response = $socket->get($input);