disallow XML document types

Serializer/XmlDeserializationVisitor.php

@@ -62,6 +62,15 @@ class XmlDeserializationVisitor extends AbstractDeserializationVisitor
     {
         $previous = libxml_use_internal_errors(true);
         $previousEntityLoaderState = libxml_disable_entity_loader($this->disableExternalEntities);
+
+        $dom = new \DOMDocument();
+        $dom->loadXML($data);
+        foreach ($dom->childNodes as $child) {
+            if ($child->nodeType === XML_DOCUMENT_TYPE_NODE) {
+                throw new \InvalidArgumentException('Document types are not allowed.');
+            }
+        }
+
         $doc = simplexml_load_string($data);
         libxml_use_internal_errors($previous);
         libxml_disable_entity_loader($previousEntityLoaderState);

Tests/Serializer/XmlSerializationTest.php

@@ -63,20 +63,28 @@ class XmlSerializationTest extends BaseSerializationTest
         $this->assertEquals($this->getContent('person_collection'), $this->serialize($personCollection));
     }
 
+    /**
+     * @expectedException \InvalidArgumentException
+     * @expectedExceptionMessage Document types are not allowed
+     */
     public function testExternalEntitiesAreDisabledByDefault()
     {
-        $currentDir = getcwd();
-        chdir(__DIR__);
-        $entity = $this->deserialize('<?xml version="1.0"?>
+        $this->deserialize('<?xml version="1.0"?>
             <!DOCTYPE author [
                 <!ENTITY foo SYSTEM "php://filter/read=convert.base64-encode/resource='.basename(__FILE__).'">
             ]>
             <result>
                 &foo;
-            </result>', 'JMS\SerializerBundle\Tests\Serializer\ExternalEntityTest');
-        chdir($currentDir);
+            </result>', 'stdClass');
+    }
 
-        $this->assertEquals('', trim($entity->foo));
+    /**
+     * @expectedException \InvalidArgumentException
+     * @expectedExceptionMessage Document types are not allowed
+     */
+    public function testDocumentTypesAreNotAllowed()
+    {
+        $this->deserialize('<?xml version="1.0"?><!DOCTYPE foo><foo></foo>', 'stdClass');
     }
 
     public function testVirtualAttributes() {
@@ -122,11 +130,4 @@ class XmlSerializationTest extends BaseSerializationTest
     {
         return 'xml';
     }
-}
-
-class ExternalEntityTest
-{
-    /** @Type("string") @XmlValue */
-    public $foo;
-}
-
+}