diff --git a/src/Symfony/Component/Serializer/Encoder/XmlEncoder.php b/src/Symfony/Component/Serializer/Encoder/XmlEncoder.php index 7923a75a1f..872949edda 100644 --- a/src/Symfony/Component/Serializer/Encoder/XmlEncoder.php +++ b/src/Symfony/Component/Serializer/Encoder/XmlEncoder.php @@ -76,6 +76,10 @@ class XmlEncoder extends SerializerAwareEncoder implements EncoderInterface, Dec libxml_use_internal_errors($internalErrors); libxml_disable_entity_loader($disableEntities); + if ($error = libxml_get_last_error()) { + throw new UnexpectedValueException($error->message); + } + foreach ($dom->childNodes as $child) { if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) { throw new UnexpectedValueException('Document types are not allowed.'); diff --git a/src/Symfony/Component/Serializer/Tests/Encoder/XmlEncoderTest.php b/src/Symfony/Component/Serializer/Tests/Encoder/XmlEncoderTest.php index b23d4c7939..07d8bd60d9 100644 --- a/src/Symfony/Component/Serializer/Tests/Encoder/XmlEncoderTest.php +++ b/src/Symfony/Component/Serializer/Tests/Encoder/XmlEncoderTest.php @@ -20,6 +20,8 @@ use Symfony\Component\Serializer\Normalizer\CustomNormalizer; class XmlEncoderTest extends \PHPUnit_Framework_TestCase { + private $encoder; + protected function setUp() { $this->encoder = new XmlEncoder; @@ -301,6 +303,14 @@ class XmlEncoderTest extends \PHPUnit_Framework_TestCase $this->assertEquals($expected, $this->encoder->decode($xml, 'xml')); } + /** + * @expectedException \Symfony\Component\Serializer\Exception\UnexpectedValueException + */ + public function testDecodeInvalidXml() + { + $this->encoder->decode('', 'xml'); + } + public function testPreventsComplexExternalEntities() { $oldCwd = getcwd();