PHP Zend_Xml_Security::scan方法代码示例

 /**
  * Load configuration XML
  * 
  * @param string $configurationXml Configuration XML
  */
 public function loadXml($configurationXml)
 {
     // Convert to SimpleXMLElement
     $configurationXml = Zend_Xml_Security::scan($configurationXml);
     // Assign general settings
     $this->DataSources->OverallQuotaInMB = (int) $configurationXml->DataSources->OverallQuotaInMB;
     // Assign Logs settings
     $this->DataSources->Logs->BufferQuotaInMB = (int) $configurationXml->DataSources->Logs->BufferQuotaInMB;
     $this->DataSources->Logs->ScheduledTransferPeriodInMinutes = (int) $configurationXml->DataSources->Logs->ScheduledTransferPeriodInMinutes;
     $this->DataSources->Logs->ScheduledTransferLogLevelFilter = (string) $configurationXml->DataSources->Logs->ScheduledTransferLogLevelFilter;
     // Assign DiagnosticInfrastructureLogs settings
     $this->DataSources->DiagnosticInfrastructureLogs->BufferQuotaInMB = (int) $configurationXml->DataSources->DiagnosticInfrastructureLogs->BufferQuotaInMB;
     $this->DataSources->DiagnosticInfrastructureLogs->ScheduledTransferPeriodInMinutes = (int) $configurationXml->DataSources->DiagnosticInfrastructureLogs->ScheduledTransferPeriodInMinutes;
     $this->DataSources->DiagnosticInfrastructureLogs->ScheduledTransferLogLevelFilter = (string) $configurationXml->DataSources->DiagnosticInfrastructureLogs->ScheduledTransferLogLevelFilter;
     // Assign PerformanceCounters settings
     $this->DataSources->PerformanceCounters->BufferQuotaInMB = (int) $configurationXml->DataSources->PerformanceCounters->BufferQuotaInMB;
     $this->DataSources->PerformanceCounters->ScheduledTransferPeriodInMinutes = (int) $configurationXml->DataSources->PerformanceCounters->ScheduledTransferPeriodInMinutes;
     if ($configurationXml->DataSources->PerformanceCounters->Subscriptions && $configurationXml->DataSources->PerformanceCounters->Subscriptions->PerformanceCounterConfiguration) {
         $subscriptions = $configurationXml->DataSources->PerformanceCounters->Subscriptions;
         if (count($subscriptions->PerformanceCounterConfiguration) > 1) {
             $subscriptions = $subscriptions->PerformanceCounterConfiguration;
         } else {
             $subscriptions = array($subscriptions->PerformanceCounterConfiguration);
         }
         foreach ($subscriptions as $subscription) {
             $this->DataSources->PerformanceCounters->addSubscription((string) $subscription->CounterSpecifier, (int) $subscription->SampleRateInSeconds);
         }
     }
     // Assign WindowsEventLog settings
     $this->DataSources->WindowsEventLog->BufferQuotaInMB = (int) $configurationXml->DataSources->WindowsEventLog->BufferQuotaInMB;
     $this->DataSources->WindowsEventLog->ScheduledTransferPeriodInMinutes = (int) $configurationXml->DataSources->WindowsEventLog->ScheduledTransferPeriodInMinutes;
     $this->DataSources->WindowsEventLog->ScheduledTransferLogLevelFilter = (string) $configurationXml->DataSources->WindowsEventLog->ScheduledTransferLogLevelFilter;
     if ($configurationXml->DataSources->WindowsEventLog->Subscriptions && $configurationXml->DataSources->WindowsEventLog->Subscriptions->string) {
         $subscriptions = $configurationXml->DataSources->WindowsEventLog->Subscriptions;
         if (count($subscriptions->string) > 1) {
             $subscriptions = $subscriptions->string;
         } else {
             $subscriptions = array($subscriptions->string);
         }
         foreach ($subscriptions as $subscription) {
             $this->DataSources->WindowsEventLog->addSubscription((string) $subscription);
         }
     }
     // Assign Directories settings
     $this->DataSources->Directories->BufferQuotaInMB = (int) $configurationXml->DataSources->Directories->BufferQuotaInMB;
     $this->DataSources->Directories->ScheduledTransferPeriodInMinutes = (int) $configurationXml->DataSources->Directories->ScheduledTransferPeriodInMinutes;
     if ($configurationXml->DataSources->Directories->Subscriptions && $configurationXml->DataSources->Directories->Subscriptions->DirectoryConfiguration) {
         $subscriptions = $configurationXml->DataSources->Directories->Subscriptions;
         if (count($subscriptions->DirectoryConfiguration) > 1) {
             $subscriptions = $subscriptions->DirectoryConfiguration;
         } else {
             $subscriptions = array($subscriptions->DirectoryConfiguration);
         }
         foreach ($subscriptions as $subscription) {
             $this->DataSources->Directories->addSubscription((string) $subscription->Path, (string) $subscription->Container, (int) $subscription->DirectoryQuotaInMB);
         }
     }
 }

 public static function scanXmlString($xmlString)
 {
     if (self::callbackChecker('Zend_Xml_Security', 'scan')) {
         //Protected method
         $xmlObj = Zend_Xml_Security::scan($xmlString);
         if (!$xmlObj) {
             throw new XenForo_Exception("Invalid XML in {$xmlObj}");
         }
     } else {
         //Classic PHP method
         $xmlObj = simplexml_load_string($xmlString);
     }
     return $xmlObj;
 }

 /**
  * Constructor
  *
  * @param string $data XML Result
  * @return void
  */
 public function __construct($data)
 {
     set_error_handler(array($this, 'handleXmlErrors'));
     $this->_sxml = Zend_Xml_Security::scan($data);
     restore_error_handler();
     if ($this->_sxml === false) {
         if ($this->_errstr === null) {
             $message = "An error occured while parsing the REST response with simplexml.";
         } else {
             $message = "REST Response Error: " . $this->_errstr;
             $this->_errstr = null;
         }
         throw new Zend_Rest_Client_Result_Exception($message);
     }
 }

 /**
  * Class constructor.  Parse the XML response from a Nirvanix method
  * call into a decorated SimpleXMLElement element.
  *
  * @param string $xml  XML response string from Nirvanix
  * @throws Zend_Service_Nirvanix_Exception
  */
 public function __construct($xml)
 {
     $this->_sxml = Zend_Xml_Security::scan($xml);
     if (!$this->_sxml instanceof SimpleXMLElement) {
         $this->_throwException("XML could not be parsed from response: {$xml}");
     }
     $name = $this->_sxml->getName();
     if ($name != 'Response') {
         $this->_throwException("Expected XML element Response, got {$name}");
     }
     $code = (int) $this->_sxml->ResponseCode;
     if ($code != 0) {
         $msg = (string) $this->_sxml->ErrorMessage;
         $this->_throwException($msg, $code);
     }
 }

 /**
  * Zend_Feed_Entry_Abstract constructor
  *
  * The Zend_Feed_Entry_Abstract constructor takes the URI of the feed the entry
  * is part of, and optionally an XML construct (usually a
  * SimpleXMLElement, but it can be an XML string or a DOMNode as
  * well) that contains the contents of the entry.
  *
  * @param  string $uri
  * @param  SimpleXMLElement|DOMNode|string  $element
  * @return void
  * @throws Zend_Feed_Exception
  */
 public function __construct($uri = null, $element = null)
 {
     if (!$element instanceof DOMElement) {
         if ($element) {
             // Load the feed as an XML DOMDocument object
             @ini_set('track_errors', 1);
             $doc = new DOMDocument();
             $doc = @Zend_Xml_Security::scan($element, $doc);
             @ini_restore('track_errors');
             if (!$doc) {
                 // prevent the class to generate an undefined variable notice (ZF-2590)
                 if (!isset($php_errormsg)) {
                     if (function_exists('xdebug_is_enabled')) {
                         $php_errormsg = '(error message not available, when XDebug is running)';
                     } else {
                         $php_errormsg = '(error message not available)';
                     }
                 }
                 /**
                  * @see Zend_Feed_Exception
                  */
                 // require_once 'Zend/Feed/Exception.php';
                 throw new Zend_Feed_Exception("DOMDocument cannot parse XML: {$php_errormsg}");
             }
             $element = $doc->getElementsByTagName($this->_rootElement)->item(0);
             if (!$element) {
                 /**
                  * @see Zend_Feed_Exception
                  */
                 // require_once 'Zend/Feed/Exception.php';
                 throw new Zend_Feed_Exception('No root <' . $this->_rootElement . '> element found, cannot parse feed.');
             }
         } else {
             $doc = new DOMDocument('1.0', 'utf-8');
             if ($this->_rootNamespace !== null) {
                 $element = $doc->createElementNS(Zend_Feed::lookupNamespace($this->_rootNamespace), $this->_rootElement);
             } else {
                 $element = $doc->createElement($this->_rootElement);
             }
         }
     }
     parent::__construct($element);
 }

 /**
  * Extract metadata from document
  *
  * @param ZipArchive $package    ZipArchive OpenXML package
  * @return array    Key-value pairs containing document meta data
  */
 protected function extractMetaData(ZipArchive $package)
 {
     // Data holders
     $coreProperties = array();
     // Read relations and search for core properties
     $relations = Zend_Xml_Security::scan($package->getFromName("_rels/.rels"));
     foreach ($relations->Relationship as $rel) {
         if ($rel["Type"] == Zend_Search_Lucene_Document_OpenXml::SCHEMA_COREPROPERTIES) {
             // Found core properties! Read in contents...
             $contents = Zend_Xml_Security::scan($package->getFromName(dirname($rel["Target"]) . "/" . basename($rel["Target"])));
             foreach ($contents->children(Zend_Search_Lucene_Document_OpenXml::SCHEMA_DUBLINCORE) as $child) {
                 $coreProperties[$child->getName()] = (string) $child;
             }
             foreach ($contents->children(Zend_Search_Lucene_Document_OpenXml::SCHEMA_COREPROPERTIES) as $child) {
                 $coreProperties[$child->getName()] = (string) $child;
             }
             foreach ($contents->children(Zend_Search_Lucene_Document_OpenXml::SCHEMA_DUBLINCORETERMS) as $child) {
                 $coreProperties[$child->getName()] = (string) $child;
             }
         }
     }
     return $coreProperties;
 }

 /**
  * Returns Flickr photo details by for the given photo ID
  *
  * @param  string $id the NSID
  * @return array of Zend_Service_Flickr_Image, details for the specified image
  * @throws Zend_Service_Exception
  */
 public function getImageDetails($id)
 {
     static $method = 'flickr.photos.getSizes';
     if (empty($id)) {
         /**
          * @see Zend_Service_Exception
          */
         #require_once 'Zend/Service/Exception.php';
         throw new Zend_Service_Exception('You must supply a photo ID');
     }
     $options = array('api_key' => $this->apiKey, 'method' => $method, 'photo_id' => $id);
     $restClient = $this->getRestClient();
     $restClient->getHttpClient()->resetParameters();
     $response = $restClient->restGet('/services/rest/', $options);
     $dom = new DOMDocument();
     $dom = Zend_Xml_Security::scan($response->getBody(), $dom);
     $xpath = new DOMXPath($dom);
     self::_checkErrors($dom);
     $retval = array();
     /**
      * @see Zend_Service_Flickr_Image
      */
     #require_once 'Zend/Service/Flickr/Image.php';
     foreach ($xpath->query('//size') as $size) {
         $label = (string) $size->getAttribute('label');
         $retval[$label] = new Zend_Service_Flickr_Image($size);
     }
     return $retval;
 }

 /**
  * Parses the provided XML text and generates data model classes for
  * each know element by turning the XML text into a DOM tree and calling
  * transferFromDOM($element).  The first data model element with the same
  * name as $this->_rootElement is used and the child elements are
  * recursively parsed.
  *
  * @param string $xml The XML text to parse
  */
 public function transferFromXML($xml)
 {
     if ($xml) {
         // Load the feed as an XML DOMDocument object
         @ini_set('track_errors', 1);
         $doc = new DOMDocument();
         $doc = @Zend_Xml_Security::scan($xml, $doc);
         @ini_restore('track_errors');
         if (!$doc) {
             // require_once 'Zend/Gdata/App/Exception.php';
             throw new Zend_Gdata_App_Exception("DOMDocument cannot parse XML: {$php_errormsg}");
         }
         $element = $doc->getElementsByTagName($this->_rootElement)->item(0);
         if (!$element) {
             // require_once 'Zend/Gdata/App/Exception.php';
             throw new Zend_Gdata_App_Exception('No root <' . $this->_rootElement . '> element');
         }
         $this->transferFromDOM($element);
     } else {
         // require_once 'Zend/Gdata/App/Exception.php';
         throw new Zend_Gdata_App_Exception('XML passed to transferFromXML cannot be null');
     }
 }

 /**
  * Save a new or updated Atom entry.
  *
  * Save is used to either create new entries or to save changes to
  * existing ones. If we have a link rel="edit", we are changing
  * an existing entry. In this case we re-serialize the entry and
  * PUT it to the edit URI, checking for a 200 OK result.
  *
  * For posting new entries, you must specify the $postUri
  * parameter to save() to tell the object where to post itself.
  * We use $postUri and POST the serialized entry there, checking
  * for a 201 Created response. If the insert is successful, we
  * then parse the response from the POST to get any values that
  * the server has generated: an id, an updated time, and its new
  * link rel="edit".
  *
  * @param  string $postUri Location to POST for creating new entries.
  * @return void
  * @throws Zend_Feed_Exception
  */
 public function save($postUri = null)
 {
     if ($this->id()) {
         // If id is set, look for link rel="edit" in the
         // entry object and PUT.
         $editUri = $this->link('edit');
         if (!$editUri) {
             /**
              * @see Zend_Feed_Exception
              */
             require_once 'Zend/Feed/Exception.php';
             throw new Zend_Feed_Exception('Cannot edit entry; no link rel="edit" is present.');
         }
         $client = Zend_Feed::getHttpClient();
         $client->setUri($editUri);
         if (Zend_Feed::getHttpMethodOverride()) {
             $client->setHeaders(array('X-HTTP-Method-Override: PUT', 'Content-Type: ' . self::CONTENT_TYPE));
             $client->setRawData($this->saveXML());
             $response = $client->request('POST');
         } else {
             $client->setHeaders('Content-Type', self::CONTENT_TYPE);
             $client->setRawData($this->saveXML());
             $response = $client->request('PUT');
         }
         if ($response->getStatus() !== 200) {
             /**
              * @see Zend_Feed_Exception
              */
             require_once 'Zend/Feed/Exception.php';
             throw new Zend_Feed_Exception('Expected response code 200, got ' . $response->getStatus());
         }
     } else {
         if ($postUri === null) {
             /**
              * @see Zend_Feed_Exception
              */
             require_once 'Zend/Feed/Exception.php';
             throw new Zend_Feed_Exception('PostURI must be specified to save new entries.');
         }
         $client = Zend_Feed::getHttpClient();
         $client->setUri($postUri);
         $client->setHeaders('Content-Type', self::CONTENT_TYPE);
         $client->setRawData($this->saveXML());
         $response = $client->request('POST');
         if ($response->getStatus() !== 201) {
             /**
              * @see Zend_Feed_Exception
              */
             require_once 'Zend/Feed/Exception.php';
             throw new Zend_Feed_Exception('Expected response code 201, got ' . $response->getStatus());
         }
     }
     // Update internal properties using $client->responseBody;
     @ini_set('track_errors', 1);
     $newEntry = new DOMDocument();
     $newEntry = @Zend_Xml_Security::scan($response->getBody(), $newEntry);
     @ini_restore('track_errors');
     if (!$newEntry) {
         // prevent the class to generate an undefined variable notice (ZF-2590)
         if (!isset($php_errormsg)) {
             if (function_exists('xdebug_is_enabled')) {
                 $php_errormsg = '(error message not available, when XDebug is running)';
             } else {
                 $php_errormsg = '(error message not available)';
             }
         }
         /**
          * @see Zend_Feed_Exception
          */
         require_once 'Zend/Feed/Exception.php';
         throw new Zend_Feed_Exception('XML cannot be parsed: ' . $php_errormsg);
     }
     $newEntry = $newEntry->getElementsByTagName($this->_rootElement)->item(0);
     if (!$newEntry) {
         /**
          * @see Zend_Feed_Exception
          */
         require_once 'Zend/Feed/Exception.php';
         throw new Zend_Feed_Exception('No root <feed> element found in server response:' . "\n\n" . $client->responseBody);
     }
//.........这里部分代码省略.........

 /**
  * Updates instance count in configuration XML.
  *
  * @param string|array $roleName			The role name
  * @param string|array $instanceCount		The instance count
  * @param string $configuration             XML configuration represented as a string
  * @throws Zend_Service_WindowsAzure_Management_Exception
  */
 protected function _updateInstanceCountInConfiguration($roleName, $instanceCount, $configuration)
 {
     // Change variables
     if (!is_array($roleName)) {
         $roleName = array($roleName);
     }
     if (!is_array($instanceCount)) {
         $instanceCount = array($instanceCount);
     }
     $configuration = preg_replace('/(<\\?xml[^?]+?)utf-16/i', '$1utf-8', $configuration);
     //$configuration = '<?xml version="1.0">' . substr($configuration, strpos($configuration, '>') + 2);
     $xml = Zend_Xml_Security::scan($configuration);
     // http://www.php.net/manual/en/simplexmlelement.xpath.php#97818
     $namespaces = $xml->getDocNamespaces();
     $xml->registerXPathNamespace('__empty_ns', $namespaces['']);
     for ($i = 0; $i < count($roleName); $i++) {
         $elements = $xml->xpath('//__empty_ns:Role[@name="' . $roleName[$i] . '"]/__empty_ns:Instances');
         if (count($elements) == 1) {
             $element = $elements[0];
             $element['count'] = $instanceCount[$i];
         }
     }
     $configuration = $xml->asXML();
     //$configuration = preg_replace('/(<\?xml[^?]+?)utf-8/i', '$1utf-16', $configuration);
     return $configuration;
 }

 /**
  * Import a feed from a string
  *
  * Protects against XXE attack vectors.
  * 
  * @param  string $feed 
  * @return string
  * @throws Zend_Feed_Exception on detection of an XXE vector
  */
 protected function _importFeedFromString($feed)
 {
     if (trim($feed) == '') {
         require_once 'Zend/Feed/Exception.php';
         throw new Zend_Feed_Exception('Remote feed being imported' . ' is an Empty string or comes from an empty HTTP response');
     }
     $doc = new DOMDocument();
     $doc = Zend_Xml_Security::scan($feed, $doc);
     if (!$doc) {
         // prevent the class to generate an undefined variable notice (ZF-2590)
         // Build error message
         $error = libxml_get_last_error();
         if ($error && $error->message) {
             $errormsg = "DOMDocument cannot parse XML: {$error->message}";
         } else {
             $errormsg = "DOMDocument cannot parse XML";
         }
         /**
          * @see Zend_Feed_Exception
          */
         require_once 'Zend/Feed/Exception.php';
         throw new Zend_Feed_Exception($errormsg);
     }
     return $doc->saveXML($doc->documentElement);
 }

 /**
  * Convert XML to SimpleXml
  * If user wants DomDocument they can use dom_import_simplexml
  *
  * @return SimpleXml Object
  */
 public function readXmlString()
 {
     $string = $this->_stream->readLongUTF();
     return Zend_Xml_Security::scan($string);
     //simplexml_load_string($string);
 }

 /**
  * Object constructor
  *
  * @param string  $fileName
  * @param boolean $storeContent
  * @throws Zend_Search_Lucene_Exception
  */
 private function __construct($fileName, $storeContent)
 {
     if (!class_exists('ZipArchive', false)) {
         require_once 'Zend/Search/Lucene/Exception.php';
         throw new Zend_Search_Lucene_Exception('MS Office documents processing functionality requires Zip extension to be loaded');
     }
     // Document data holders
     $documentBody = array();
     $coreProperties = array();
     // Open OpenXML package
     $package = new ZipArchive();
     $package->open($fileName);
     // Read relations and search for officeDocument
     $relationsXml = $package->getFromName('_rels/.rels');
     if ($relationsXml === false) {
         require_once 'Zend/Search/Lucene/Exception.php';
         throw new Zend_Search_Lucene_Exception('Invalid archive or corrupted .docx file.');
     }
     $relations = Zend_Xml_Security::scan($relationsXml);
     foreach ($relations->Relationship as $rel) {
         if ($rel["Type"] == Zend_Search_Lucene_Document_OpenXml::SCHEMA_OFFICEDOCUMENT) {
             // Found office document! Read in contents...
             $contents = Zend_Xml_Security::scan($package->getFromName($this->absoluteZipPath(dirname($rel['Target']) . '/' . basename($rel['Target']))));
             $contents->registerXPathNamespace('w', Zend_Search_Lucene_Document_Docx::SCHEMA_WORDPROCESSINGML);
             $paragraphs = $contents->xpath('//w:body/w:p');
             foreach ($paragraphs as $paragraph) {
                 $runs = $paragraph->xpath('.//w:r/*[name() = "w:t" or name() = "w:br"]');
                 if ($runs === false) {
                     // Paragraph doesn't contain any text or breaks
                     continue;
                 }
                 foreach ($runs as $run) {
                     if ($run->getName() == 'br') {
                         // Break element
                         $documentBody[] = ' ';
                     } else {
                         $documentBody[] = (string) $run;
                     }
                 }
                 // Add space after each paragraph. So they are not bound together.
                 $documentBody[] = ' ';
             }
             break;
         }
     }
     // Read core properties
     $coreProperties = $this->extractMetaData($package);
     // Close file
     $package->close();
     // Store filename
     $this->addField(Zend_Search_Lucene_Field::Text('filename', $fileName, 'UTF-8'));
     // Store contents
     if ($storeContent) {
         $this->addField(Zend_Search_Lucene_Field::Text('body', implode('', $documentBody), 'UTF-8'));
     } else {
         $this->addField(Zend_Search_Lucene_Field::UnStored('body', implode('', $documentBody), 'UTF-8'));
     }
     // Store meta data properties
     foreach ($coreProperties as $key => $value) {
         $this->addField(Zend_Search_Lucene_Field::Text($key, $value, 'UTF-8'));
     }
     // Store title (if not present in meta data)
     if (!isset($coreProperties['title'])) {
         $this->addField(Zend_Search_Lucene_Field::Text('title', $fileName, 'UTF-8'));
     }
 }

 /**
  * Set Message
  *
  * @param string $msg XML string
  * @return Zend_Mobile_Push_Message_Mpns_Raw
  * @throws Zend_Mobile_Push_Message_Exception
  */
 public function setMessage($msg)
 {
     if (!is_string($msg)) {
         throw new Zend_Mobile_Push_Message_Exception('$msg is not a string');
     }
     if (!Zend_Xml_Security::scan($msg)) {
         throw new Zend_Mobile_Push_Message_Exception('$msg is not valid xml');
     }
     $this->_msg = $msg;
     return $this;
 }

    public function testScanXmlWithDTD()
    {
        $xml = <<<XML
<?xml version="1.0"?>
<!DOCTYPE results [
<!ELEMENT results (result+)>
<!ELEMENT result (#PCDATA)>
]>
<results>
    <result>test</result>
</results>
XML;
        $dom = new DOMDocument('1.0');
        $result = Zend_Xml_Security::scan($xml, $dom);
        $this->assertTrue($result instanceof DOMDocument);
        $this->assertTrue($result->validate());
    }