wp-includes/ID3/getid3.lib.php:741$XMLstringstringarray|false public static function XML2array($XMLstring) { if (function_exists('simplexml_load_string')) { if (PHP_VERSION_ID < 80000) { if (function_exists('libxml_disable_entity_loader')) { // http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html // https://core.trac.wordpress.org/changeset/29378 // This function has been deprecated in PHP 8.0 because in libxml 2.9.0, external entity loading is // disabled by default, but is still needed when LIBXML_NOENT is used. $loader = @libxml_disable_entity_loader(true); $XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', GETID3_LIBXML_OPTIONS); $return = self::SimpleXMLelement2array($XMLobject); @libxml_disable_entity_loader($loader); return $return; } } else { $allow = false; if (defined('LIBXML_VERSION') && (LIBXML_VERSION >= 20900)) { // https://www.php.net/manual/en/function.libxml-disable-entity-loader.php // "as of libxml 2.9.0 entity substitution is disabled by default, so there is no need to disable the loading // of external entities, unless there is the need to resolve internal entity references with LIBXML_NOENT." $allow = true; } elseif (function_exists('libxml_set_external_entity_loader')) { libxml_set_external_entity_loader(function () { return null; }); // https://www.zend.com/blog/cve-2023-3823 $allow = true; } if ($allow) { $XMLobject = simplexml_load_string($XMLstring, 'SimpleXMLElement', GETID3_LIBXML_OPTIONS); $return = self::SimpleXMLelement2array($XMLobject); return $return; } } } return false; }Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/ID3/getid3.lib.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.