Config file has leading content

[waja]

Hi,

with the latest release of 27.0.1 the container stopped working with:

Warning: [snuffleupagus][0.0.0.0][xxe][log] A call to libxml_set_external_entity_loader was tried and nopped in /nextcloud/lib/base.php on line 592
Config file has leading content, please remove everything before "<?php" in config.php
Fatal error: Uncaught Error: Typed static property OC::$server must not be accessed before initialization in /nextcloud/index.php:71 Stack trace: #0 {main} thrown in /nextcloud/index.php on line 71

but:

/nextcloud/config $ head -2 config.php
<?php
$CONFIG = array (

Thanks Jan

[rmeissn]

I got the same problem for 26.0.4 (coming from 26.0.3)

[ricanbm]

Same issue here.

I reverted my container to v27.0.0 which works ok, until this is fixed

[waja]

Unfortunately I wasn't able to find where snuffleupagus is logging it's error logs to trace the issue down.

[hoellen]

Sorry guys, I'm on vacation and therefore limited in my testing. The reason is probably that with nextcloud/server#39490 Nextcloud tries now to prevent any XML processing from loading external entities. Snuffleupagus prevents this with xxe-protection, too. The call of libxml_set_external_entity_loader from Nextcloud is then logged by Snuffleupagus. I believe that this log is interfering with loading the config file.

Instead of reverting to 27.0.0, another workaround is disabling snuffleupagus with PHP_HARDENING=false.
If my commit (2d3fd8f) fixes it for you, I will backport it to the other Nextcloud versions. Maybe I can find a way of disabling the log in snuffleupagus or allow using the function from Nextcloud after my vacation.

[waja]

Sorry guys, I'm on vacation and therefore limited in my testing.

Don't hurry. Take your time for your vacation!

[mrplow]

Instead of reverting to 27.0.0, another workaround is disabling snuffleupagus with PHP_HARDENING=false.

This workaround resolved it for me.

Enjoy your vacation!

[hoellen]

@mrplow I commited a possible fix earlier. Could you please try it without the workaround (PHP_HARDENING=true)?

[mrplow]

@mrplow I commited a possible fix earlier. Could you please try it without the workaround (PHP_HARDENING=true)?

Yes, using the latest works without they workaround

[hoellen]

Nextcloud version 26 and 25 should now work again, too.

[waja]

Do you plan to (re-)enable the xxe protection in the future?

[hoellen]

I reached out to the maintainer of Snuffleupagus and he'll fix the issue eventually at some point. After that I'll re-enable xxe protection again. Since Nextcloud now prevents XML processing itself when loading external entities, I don't think this is a high risk at the moment.