[wp-trac] [WordPress Trac] #24408: HTTPd Error Log: body.xml:1: parser error : Document labelled UTF-16 but has UTF-8 content

[WordPress Trac]

#24408: HTTPd Error Log: body.xml:1: parser error : Document labelled UTF-16 but
has UTF-8 content
-------------------------------------------+------------------------------
 Reporter:  crashnet                       |       Owner:
     Type:  defect (bug)                   |      Status:  new
 Priority:  normal                         |   Milestone:  Awaiting Review
Component:  XML-RPC                        |     Version:  3.5.1
 Severity:  normal                         |  Resolution:
 Keywords:  2nd-opinion reporter-feedback  |
-------------------------------------------+------------------------------

Comment (by theresa95):

 It is due to attempts to smuggle bad XML in request body.

 E.g. a similar line is logged in ModSecurity logs for some requests made
 to a WP install, when ModSecurity XML body parser is enabled:

 {{{
 [msg "Failed to parse request body."] [data "XML parser error: XML: Failed
 parsing document."][uri "/xmlrpc.php"]
 body.xml:1: parser error : Document labelled UTF-16 but has UTF-8 content
 <?xml version="1.0" encoding="utf-16" standalone="yes"?>
 }}}


 Here is a how to raise the same error, in some PHP versions (where the
 passed in argument is in UTF-8):

 {{{
 <?php
 $xml = simplexml_load_string('<?xml version="1.0" encoding="utf-16"?>');
 }}}

--
Ticket URL: <http://core.trac.wordpress.org/ticket/24408#comment:8>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software