Merge pull request #39498 from nextcloud/backport/39490/stable20

[stable20] fix(apps): Fix loading info.xml file

lib/base.php

@@ -552,6 +552,11 @@ class OC {
 	}
 
 	public static function init() {
+		// prevent any XML processing from loading external entities
+		libxml_set_external_entity_loader(static function () {
+			return null;
+		});
+
 		// calculate the root directories
 		OC::$SERVERROOT = str_replace("\\", '/', substr(__DIR__, 0, -4));
 

lib/private/App/CodeChecker/DatabaseSchemaChecker.php

@@ -42,7 +42,7 @@ class DatabaseSchemaChecker {
 
 		libxml_use_internal_errors(true);
 		$loadEntities = libxml_disable_entity_loader(false);
-		$xml = simplexml_load_file($appPath . '/appinfo/database.xml');
+		$xml = simplexml_load_string(file_get_contents($appPath . '/appinfo/database.xml'));
 		libxml_disable_entity_loader($loadEntities);
 
 

lib/private/App/CodeChecker/InfoChecker.php

@@ -44,6 +44,14 @@ class InfoChecker extends BasicEmitter {
 			throw new \RuntimeException("No app with given id <$appId> known.");
 		}
 
+		libxml_set_external_entity_loader(static function ($public, $system, $context) {
+			if ($system === \OC::$SERVERROOT . '/resources/app-info.xsd'
+				|| \OC::$SERVERROOT . '/resources/app-info-shipped.xsd') {
+				return $system;
+			}
+			return null;
+		});
+
 		$xml = new \DOMDocument();
 		$xml->load($appPath . '/appinfo/info.xml');
 
@@ -68,6 +76,10 @@ class InfoChecker extends BasicEmitter {
 			}
 		}
 
+		libxml_set_external_entity_loader(static function () {
+			return null;
+		});
+
 		return $errors;
 	}
 

lib/private/App/InfoParser.php

@@ -62,7 +62,7 @@ class InfoParser {
 
 		libxml_use_internal_errors(true);
 		$loadEntities = libxml_disable_entity_loader(false);
-		$xml = simplexml_load_file($file);
+		$xml = simplexml_load_string(file_get_contents($file));
 
 		libxml_disable_entity_loader($loadEntities);
 		if ($xml === false) {

lib/private/DB/MDB2SchemaReader.php

@@ -67,7 +67,7 @@ class MDB2SchemaReader {
 	 */
 	public function loadSchemaFromFile($file, Schema $schema) {
 		$loadEntities = libxml_disable_entity_loader(false);
-		$xml = simplexml_load_file($file);
+		$xml = simplexml_load_string(file_get_contents($file));
 		libxml_disable_entity_loader($loadEntities);
 		foreach ($xml->children() as $child) {
 			/**

lib/private/Installer.php

@@ -316,7 +316,7 @@ class Installer {
 
 						// Check if appinfo/info.xml has the same app ID as well
 						$loadEntities = libxml_disable_entity_loader(false);
-						$xml = simplexml_load_file($extractDir . '/' . $folders[0] . '/appinfo/info.xml');
+						$xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml'));
 						libxml_disable_entity_loader($loadEntities);
 						if ((string)$xml->id !== $appId) {
 							throw new \Exception(