From 536a1b89d73c1f7a14322839cd5598eddb3d1cfc Mon Sep 17 00:00:00 2001
From: troosan <antoine.de.troostembergh@gmail.com>
Date: Sat, 14 Jul 2018 00:50:01 +0200
Subject: [PATCH 1/3] disable entity loader

---
 composer.json                           | 2 +-
 src/PhpWord/Shared/Html.php             | 1 +
 src/PhpWord/TemplateProcessor.php       | 1 +
 tests/PhpWord/_includes/XmlDocument.php | 2 ++
 4 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/composer.json b/composer.json
index 9a14618e..4bba86b3 100644
--- a/composer.json
+++ b/composer.json
@@ -66,7 +66,7 @@
     "require-dev": {
         "ext-zip": "*",
         "ext-gd": "*",
-        "phpunit/phpunit": "^4.8.36 || ^5.0",
+        "phpunit/phpunit": "^4.8.36 || ^7.0",
         "squizlabs/php_codesniffer": "^2.9",
         "friendsofphp/php-cs-fixer": "^2.2",
         "phpmd/phpmd": "2.*",
diff --git a/src/PhpWord/Shared/Html.php b/src/PhpWord/Shared/Html.php
index 239cfd1d..a4281678 100644
--- a/src/PhpWord/Shared/Html.php
+++ b/src/PhpWord/Shared/Html.php
@@ -71,6 +71,7 @@ class Html
         }
 
         // Load DOM
+        libxml_disable_entity_loader(true);
         $dom = new \DOMDocument();
         $dom->preserveWhiteSpace = $preserveWhiteSpace;
         $dom->loadXML($html);
diff --git a/src/PhpWord/TemplateProcessor.php b/src/PhpWord/TemplateProcessor.php
index 72446ae7..946d6691 100644
--- a/src/PhpWord/TemplateProcessor.php
+++ b/src/PhpWord/TemplateProcessor.php
@@ -113,6 +113,7 @@ class TemplateProcessor
      */
     protected function transformSingleXml($xml, $xsltProcessor)
     {
+        libxml_disable_entity_loader(true);
         $domDocument = new \DOMDocument();
         if (false === $domDocument->loadXML($xml)) {
             throw new Exception('Could not load the given XML document.');
diff --git a/tests/PhpWord/_includes/XmlDocument.php b/tests/PhpWord/_includes/XmlDocument.php
index 8c937bf5..81de7eff 100644
--- a/tests/PhpWord/_includes/XmlDocument.php
+++ b/tests/PhpWord/_includes/XmlDocument.php
@@ -76,8 +76,10 @@ class XmlDocument
         $this->file = $file;
 
         $file = $this->path . '/' . $file;
+        libxml_disable_entity_loader(false);
         $this->dom = new \DOMDocument();
         $this->dom->load($file);
+        libxml_disable_entity_loader(true);
 
         return $this->dom;
     }

From 96b21badaf99442f2a1de5a1b2298ae371d0e901 Mon Sep 17 00:00:00 2001
From: troosan <antoine.de.troostembergh@gmail.com>
Date: Sat, 14 Jul 2018 00:54:41 +0200
Subject: [PATCH 2/3] update changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cdd78870..d2b009dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -37,6 +37,7 @@ v0.15.0 (?? ??? 2018)
 - Fix parsing of Heading and Title formating @troosan @gthomas2 #465
 - Fix Dateformat typo, fix hours casing, add Month-Day-Year formats @ComputerTinker #591
 - Fix missing column width in ODText writer @potofcoffee #413
+- Disable entity loader before parsing XML to avoid XXE injection @Tom4t0 #1427
 
 ### Changed
 - Remove zend-stdlib dependency @Trainmaster #1284

From 4c4c6f43ca446c0998f925f52b3b1aa3fe5289bb Mon Sep 17 00:00:00 2001
From: troosan <antoine.de.troostembergh@gmail.com>
Date: Sat, 14 Jul 2018 00:59:54 +0200
Subject: [PATCH 3/3] remove options not compatible with latest phpunit version

---
 phpunit.xml.dist | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index 015dd2ed..17fcfa39 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -6,8 +6,7 @@
          convertNoticesToExceptions="true"
          convertWarningsToExceptions="true"
          processIsolation="false"
-         stopOnFailure="false"
-         syntaxCheck="false">
+         stopOnFailure="false">
     <testsuites>
         <testsuite name="PhpWord Test Suite">
             <directory>./tests/PhpWord</directory>
@@ -22,7 +21,7 @@
         </whitelist>
     </filter>
     <logging>
-        <log type="coverage-html" target="./build/coverage" charset="UTF-8" highlight="true" />
+        <log type="coverage-html" target="./build/coverage" />
         <log type="coverage-clover" target="./build/logs/clover.xml" />
     </logging>
 </phpunit>
\ No newline at end of file