XXE and Nextcloud

[jvoisin]

XXE and Nextcloud

[jvoisin]

I guess there is some logging-related shenenigans in how nextcloud handles configuration processing, as in it doesn't exploit Snuffleupagus to complain when it loads its configuration. I don't think there is much that can be done here from Snuffleupagus' side unfortunately.

Anyway, since Nextcloud is explicitly disabling XXE, there is no need to sp.xxe_protection.enable();; it can simply be replaced with something like this:

sp.disable_function.function("libxml_set_external_entity_loader").filename("/nextcloud/lib/base.php").allow(); 
sp.disable_function.function("libxml_set_external_entity_loader").drop(); 

[hoellen]

Thank you for your suggestion of dropping the call oflibxml_set_external_entity_loader.