diff -rpNU 30 ../modsecurity-apache_2.7.1-o/apache2/apache2_config.c ./apache2/apache2_config.c
--- ../modsecurity-apache_2.7.1-o/apache2/apache2_config.c	2012-11-14 03:25:56.000000000 +0100
+++ ./apache2/apache2_config.c	2013-04-05 16:03:41.000000000 +0200
@@ -125,60 +125,63 @@ void *create_directory_config(apr_pool_t
     dcfg->cache_trans_incremental = NOT_SET;
     dcfg->cache_trans_min = NOT_SET;
     dcfg->cache_trans_max = NOT_SET;
     dcfg->cache_trans_maxitems = NOT_SET;
 
     dcfg->component_signatures = apr_array_make(mp, 16, sizeof(char *));
 
     dcfg->request_encoding = NOT_SET_P;
     dcfg->disable_backend_compression = NOT_SET;
 
     /* Collection timeout */
     dcfg->col_timeout = NOT_SET;
 
     dcfg->crypto_key = NOT_SET_P;
     dcfg->crypto_key_len = NOT_SET;
     dcfg->crypto_key_add = NOT_SET;
     dcfg->crypto_param_name = NOT_SET_P;
     dcfg->hash_is_enabled = NOT_SET;
     dcfg->hash_enforcement = NOT_SET;
     dcfg->crypto_hash_href_rx = NOT_SET;
     dcfg->crypto_hash_faction_rx = NOT_SET;
     dcfg->crypto_hash_location_rx = NOT_SET;
     dcfg->crypto_hash_iframesrc_rx = NOT_SET;
     dcfg->crypto_hash_framesrc_rx = NOT_SET;
     dcfg->crypto_hash_href_pm = NOT_SET;
     dcfg->crypto_hash_faction_pm = NOT_SET;
     dcfg->crypto_hash_location_pm = NOT_SET;
     dcfg->crypto_hash_iframesrc_pm = NOT_SET;
     dcfg->crypto_hash_framesrc_pm = NOT_SET;
 
+    /* xml external entity */
+    dcfg->xml_external_entity = NOT_SET; 
+
 
     return dcfg;
 }
 
 /**
  * Copies rules between one phase of two configuration contexts,
  * taking exceptions into account.
  */
 static void copy_rules_phase(apr_pool_t *mp,
                              apr_array_header_t *parent_phase_arr,
                              apr_array_header_t *child_phase_arr,
                              apr_array_header_t *exceptions_arr)
 {
     rule_exception **exceptions;
     msre_rule **rules;
     int i, j;
     int mode = 0;
 
     rules = (msre_rule **)parent_phase_arr->elts;
     for(i = 0; i < parent_phase_arr->nelts; i++) {
         msre_rule *rule = (msre_rule *)rules[i];
         int copy = 1;
 
         if (mode == 0) {
             /* First rule in the chain. */
             exceptions = (rule_exception **)exceptions_arr->elts;
             for(j = 0; j < exceptions_arr->nelts; j++) {
 
                 /* Process exceptions. */
                 switch(exceptions[j]->type) {
@@ -559,60 +562,64 @@ void *merge_directory_configs(apr_pool_t
         ? parent->crypto_key_len : child->crypto_key_len);
     merged->crypto_key_add = (child->crypto_key_add == NOT_SET
         ? parent->crypto_key_add : child->crypto_key_add);
     merged->crypto_param_name = (child->crypto_param_name == NOT_SET_P
         ? parent->crypto_param_name : child->crypto_param_name);
     merged->hash_is_enabled = (child->hash_is_enabled == NOT_SET
         ? parent->hash_is_enabled : child->hash_is_enabled);
     merged->hash_enforcement = (child->hash_enforcement == NOT_SET
         ? parent->hash_enforcement : child->hash_enforcement);
     merged->crypto_hash_href_rx = (child->crypto_hash_href_rx == NOT_SET
         ? parent->crypto_hash_href_rx : child->crypto_hash_href_rx);
     merged->crypto_hash_faction_rx = (child->crypto_hash_faction_rx == NOT_SET
         ? parent->crypto_hash_faction_rx : child->crypto_hash_faction_rx);
     merged->crypto_hash_location_rx = (child->crypto_hash_location_rx == NOT_SET
         ? parent->crypto_hash_location_rx : child->crypto_hash_location_rx);
     merged->crypto_hash_iframesrc_rx = (child->crypto_hash_iframesrc_rx == NOT_SET
         ? parent->crypto_hash_iframesrc_rx : child->crypto_hash_iframesrc_rx);
     merged->crypto_hash_framesrc_rx = (child->crypto_hash_framesrc_rx == NOT_SET
         ? parent->crypto_hash_framesrc_rx : child->crypto_hash_framesrc_rx);
     merged->crypto_hash_href_pm = (child->crypto_hash_href_pm == NOT_SET
         ? parent->crypto_hash_href_pm : child->crypto_hash_href_pm);
     merged->crypto_hash_faction_pm = (child->crypto_hash_faction_pm == NOT_SET
         ? parent->crypto_hash_faction_pm : child->crypto_hash_faction_pm);
     merged->crypto_hash_location_pm = (child->crypto_hash_location_pm == NOT_SET
         ? parent->crypto_hash_location_pm : child->crypto_hash_location_pm);
     merged->crypto_hash_iframesrc_pm = (child->crypto_hash_iframesrc_pm == NOT_SET
         ? parent->crypto_hash_iframesrc_pm : child->crypto_hash_iframesrc_pm);
     merged->crypto_hash_framesrc_pm = (child->crypto_hash_framesrc_pm == NOT_SET
         ? parent->crypto_hash_framesrc_pm : child->crypto_hash_framesrc_pm);
 
+    /* xml external entity */
+    merged->xml_external_entity = (child->xml_external_entity == NOT_SET
+	? parent->xml_external_entity : child->xml_external_entity);
+
     return merged;
 }
 
 /**
  * Initialise directory configuration. This function is *not* meant
  * to be called for directory configuration instances created during
  * the configuration phase. It can only be called on copies of those
  * (created fresh for every transaction).
  */
 void init_directory_config(directory_config *dcfg)
 {
     if (dcfg == NULL) return;
 
     if (dcfg->is_enabled == NOT_SET) dcfg->is_enabled = 0;
 
     if (dcfg->reqbody_access == NOT_SET) dcfg->reqbody_access = 0;
     if (dcfg->reqintercept_oe == NOT_SET) dcfg->reqintercept_oe = 0;
     if (dcfg->reqbody_buffering == NOT_SET) dcfg->reqbody_buffering = REQUEST_BODY_FORCEBUF_OFF;
     if (dcfg->reqbody_inmemory_limit == NOT_SET)
         dcfg->reqbody_inmemory_limit = REQUEST_BODY_DEFAULT_INMEMORY_LIMIT;
     if (dcfg->reqbody_limit == NOT_SET) dcfg->reqbody_limit = REQUEST_BODY_DEFAULT_LIMIT;
     if (dcfg->reqbody_no_files_limit == NOT_SET) dcfg->reqbody_no_files_limit = REQUEST_BODY_NO_FILES_DEFAULT_LIMIT;
     if (dcfg->resbody_access == NOT_SET) dcfg->resbody_access = 0;
     if (dcfg->of_limit == NOT_SET) dcfg->of_limit = RESPONSE_BODY_DEFAULT_LIMIT;
     if (dcfg->if_limit_action == NOT_SET) dcfg->if_limit_action = REQUEST_BODY_LIMIT_ACTION_REJECT;
     if (dcfg->of_limit_action == NOT_SET) dcfg->of_limit_action = RESPONSE_BODY_LIMIT_ACTION_REJECT;
 
     if (dcfg->of_mime_types == NOT_SET_P) {
         dcfg->of_mime_types = apr_table_make(dcfg->mp, 3);
         if (dcfg->of_mime_types_cleared != 1) {
@@ -678,60 +685,62 @@ void init_directory_config(directory_con
     if (dcfg->cache_trans == NOT_SET) dcfg->cache_trans = MODSEC_CACHE_DISABLED;
     if (dcfg->cache_trans_incremental == NOT_SET) dcfg->cache_trans_incremental = 0;
     if (dcfg->cache_trans_min == (apr_size_t)NOT_SET) dcfg->cache_trans_min = 32;
     if (dcfg->cache_trans_max == (apr_size_t)NOT_SET) dcfg->cache_trans_max = 1024;
     if (dcfg->cache_trans_maxitems == (apr_size_t)NOT_SET) dcfg->cache_trans_maxitems = 512;
 
     if (dcfg->request_encoding == NOT_SET_P) dcfg->request_encoding = NULL;
 
     if (dcfg->disable_backend_compression == NOT_SET) dcfg->disable_backend_compression = 0;
 
     if (dcfg->col_timeout == NOT_SET) dcfg->col_timeout = 3600;
 
     /* Hash */
     if (dcfg->crypto_key == NOT_SET_P) dcfg->crypto_key = getkey(dcfg->mp);
     if (dcfg->crypto_key_len == NOT_SET) dcfg->crypto_key_len = strlen(dcfg->crypto_key);
     if (dcfg->crypto_key_add == NOT_SET) dcfg->crypto_key_add = HASH_KEYONLY;
     if (dcfg->crypto_param_name == NOT_SET_P) dcfg->crypto_param_name = "crypt";
     if (dcfg->hash_is_enabled == NOT_SET) dcfg->hash_is_enabled = HASH_DISABLED;
     if (dcfg->hash_enforcement == NOT_SET) dcfg->hash_enforcement = HASH_DISABLED;
     if (dcfg->crypto_hash_href_rx == NOT_SET) dcfg->crypto_hash_href_rx = 0;
     if (dcfg->crypto_hash_faction_rx == NOT_SET) dcfg->crypto_hash_faction_rx = 0;
     if (dcfg->crypto_hash_location_rx == NOT_SET) dcfg->crypto_hash_location_rx = 0;
     if (dcfg->crypto_hash_iframesrc_rx == NOT_SET) dcfg->crypto_hash_iframesrc_rx = 0;
     if (dcfg->crypto_hash_framesrc_rx == NOT_SET) dcfg->crypto_hash_framesrc_rx = 0;
     if (dcfg->crypto_hash_href_pm == NOT_SET) dcfg->crypto_hash_href_pm = 0;
     if (dcfg->crypto_hash_faction_pm == NOT_SET) dcfg->crypto_hash_faction_pm = 0;
     if (dcfg->crypto_hash_location_pm == NOT_SET) dcfg->crypto_hash_location_pm = 0;
     if (dcfg->crypto_hash_iframesrc_pm == NOT_SET) dcfg->crypto_hash_iframesrc_pm = 0;
     if (dcfg->crypto_hash_framesrc_pm == NOT_SET) dcfg->crypto_hash_framesrc_pm = 0;
 
+    if (dcfg->xml_external_entity == NOT_SET) dcfg->xml_external_entity = 0;
+
 }
 
 /**
  *
  */
 static const char *add_rule(cmd_parms *cmd, directory_config *dcfg, int type,
                             const char *p1, const char *p2, const char *p3)
 {
     char *my_error_msg = NULL;
     msre_rule *rule = NULL, *tmp_rule = NULL;
     extern msc_engine *modsecurity;
     int offset = 0;
 
     #ifdef DEBUG_CONF
     ap_log_perror(APLOG_MARK, APLOG_STARTUP|APLOG_NOERRNO, 0, cmd->pool,
         "Rule: type=%d p1='%s' p2='%s' p3='%s'", type, p1, p2, p3);
     #endif
 
     /* Create a ruleset if one does not exist. */
     if ((dcfg->ruleset == NULL)||(dcfg->ruleset == NOT_SET_P)) {
         dcfg->ruleset = msre_ruleset_create(modsecurity->msre, cmd->pool);
         if (dcfg->ruleset == NULL) return FATAL_ERROR;
     }
 
     /* Create the rule now. */
     switch(type) {
         #if defined(WITH_LUA)
         case RULE_TYPE_LUA :
             rule = msre_rule_lua_create(dcfg->ruleset, cmd->directive->filename,
                 cmd->directive->line_num, p1, p2, &my_error_msg);
@@ -2226,85 +2235,111 @@ static const char *cmd_upload_keep_files
     } else
     if (strcasecmp(p1, "relevantonly") == 0) {
         dcfg->upload_keep_files = KEEP_FILES_RELEVANT_ONLY;
     } else {
         return apr_psprintf(cmd->pool, "ModSecurity: Invalid setting for SecUploadKeepFiles: %s",
             p1);
     }
     return NULL;
 }
 
 static const char *cmd_web_app_id(cmd_parms *cmd, void *_dcfg, const char *p1)
 {
     directory_config *dcfg = (directory_config *)_dcfg;
 
     /* ENH enforce format (letters, digits, ., _, -) */
     dcfg->webappid = p1;
 
     return NULL;
 }
 
 static const char *cmd_sensor_id(cmd_parms *cmd, void *_dcfg, const char *p1)
 {
     directory_config *dcfg = (directory_config *)_dcfg;
 
     /* ENH enforce format (letters, digits, ., _, -) */
     dcfg->sensor_id = p1;
 
     return NULL;
 }
 
+/**
+* \brief Add SecXmlExternalEntity configuration option
+*
+* \param cmd Pointer to configuration data
+* \param _dcfg Pointer to directory configuration
+* \param p1 Pointer to configuration option
+*
+* \retval NULL On failure
+* \retval apr_psprintf On Success
+*/
+static const char *cmd_xml_external_entity(cmd_parms *cmd, void *_dcfg, const char *p1)
+{
+    directory_config *dcfg = (directory_config *)_dcfg;
+    if (dcfg == NULL) return NULL;
+
+    if (strcasecmp(p1, "on") == 0)  {
+        dcfg->xml_external_entity = 1;
+    }
+    else if (strcasecmp(p1, "off") == 0)    {
+        dcfg->xml_external_entity = 0;
+    }
+    else return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for SecXmlExternalEntity: %s", p1);
+
+    return NULL;
+} 
+
 
 /**
-* \brief Add SecHash configuration option
+* \brief Add SecHashEngine configuration option
 *
 * \param cmd Pointer to configuration data
 * \param _dcfg Pointer to directory configuration
 * \param p1 Pointer to configuration option
 *
 * \retval NULL On failure
 * \retval apr_psprintf On Success
 */
 static const char *cmd_hash_engine(cmd_parms *cmd, void *_dcfg, const char *p1)
 {
     directory_config *dcfg = (directory_config *)_dcfg;
     if (dcfg == NULL) return NULL;
 
     if (strcasecmp(p1, "on") == 0)  {
         dcfg->hash_is_enabled = HASH_ENABLED;
         dcfg->hash_enforcement = HASH_ENABLED;
     }
     else if (strcasecmp(p1, "off") == 0)    {
         dcfg->hash_is_enabled = HASH_DISABLED;
         dcfg->hash_enforcement = HASH_DISABLED;
     }
-    else return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for SecRuleEngine: %s", p1);
+    else return apr_psprintf(cmd->pool, "ModSecurity: Invalid value for SecHashEngine: %s", p1);
 
     return NULL;
 }
 
 /**
 * \brief Add SecHashPram configuration option
 *
 * \param cmd Pointer to configuration data
 * \param _dcfg Pointer to directory configuration
 * \param p1 Pointer to configuration option
 *
 * \retval NULL On success
 */
 static const char *cmd_hash_param(cmd_parms *cmd, void *_dcfg, const char *p1)
 {
     directory_config *dcfg = (directory_config *)_dcfg;
 
     if (dcfg == NULL) return NULL;
 
     if (p1 == NULL) return NULL;
     dcfg->crypto_param_name = p1;
 
     return NULL;
 }
 
 /**
 * \brief Add SecHashKey configuration option
 *
 * \param cmd Pointer to configuration data
 * \param _dcfg Pointer to directory configuration
@@ -3135,60 +3170,68 @@ const command_rec module_directives[] =
         cmd_response_body_mime_type,
         NULL,
         CMD_SCOPE_ANY,
         "adds given MIME types to the list of types that will be buffered on output"
     ),
 
     AP_INIT_NO_ARGS (
         "SecResponseBodyMimeTypesClear",
         cmd_response_body_mime_types_clear,
         NULL,
         CMD_SCOPE_ANY,
         "clears the list of MIME types that will be buffered on output"
     ),
 
     AP_INIT_TAKE23 (
         "SecRule",
         cmd_rule,
         NULL,
         CMD_SCOPE_ANY,
         "rule target, operator and optional action list"
     ),
 
     AP_INIT_TAKE1 (
         "SecRuleEngine",
         cmd_rule_engine,
         NULL,
         CMD_SCOPE_ANY,
         "On or Off"
     ),
 
+    AP_INIT_TAKE1 (
+	"SecXmlExternalEntity",
+	cmd_xml_external_entity,
+	NULL,
+	CMD_SCOPE_ANY,
+	"On or Off"
+    ),
+
     AP_INIT_FLAG (
         "SecRuleInheritance",
         cmd_rule_inheritance,
         NULL,
         CMD_SCOPE_ANY,
         "On or Off"
     ),
 
     AP_INIT_TAKE12 (
         "SecRuleScript",
         cmd_rule_script,
         NULL,
         CMD_SCOPE_ANY,
         "rule script and optional actionlist"
     ),
 
     AP_INIT_ITERATE (
         "SecRuleRemoveById",
         cmd_rule_remove_by_id,
         NULL,
         CMD_SCOPE_ANY,
         "rule ID for removal"
     ),
 
     AP_INIT_ITERATE (
         "SecRuleRemoveByTag",
         cmd_rule_remove_by_tag,
         NULL,
         CMD_SCOPE_ANY,
         "rule tag for removal"
diff -rpNU 30 ../modsecurity-apache_2.7.1-o/apache2/modsecurity.h ./apache2/modsecurity.h
--- ../modsecurity-apache_2.7.1-o/apache2/modsecurity.h	2012-11-14 03:25:56.000000000 +0100
+++ ./apache2/modsecurity.h	2013-04-05 16:04:41.000000000 +0200
@@ -562,60 +562,61 @@ struct directory_config {
      * appear in the ModSecurity signature in the audit log.
      */
     apr_array_header_t  *component_signatures;
 
     /* Request character encoding. */
     const char          *request_encoding;
 
     int disable_backend_compression;
 
     /* Collection timeout */
     int col_timeout;
 
     /* Hash */
     apr_array_header_t  *hash_method;
     const char *crypto_key;
     int                 crypto_key_len;
     const char          *crypto_param_name;
     int                 hash_is_enabled;
     int                 hash_enforcement;
     int                 crypto_key_add;
     int                 crypto_hash_href_rx;
     int                 crypto_hash_faction_rx;
     int                 crypto_hash_location_rx;
     int                 crypto_hash_iframesrc_rx;
     int                 crypto_hash_framesrc_rx;
     int                 crypto_hash_href_pm;
     int                 crypto_hash_faction_pm;
     int                 crypto_hash_location_pm;
     int                 crypto_hash_iframesrc_pm;
     int                 crypto_hash_framesrc_pm;
+    int			xml_external_entity;	/* xml */
 };
 
 struct error_message_t {
     const char          *file;
     int                  line;
     int                  level;
     apr_status_t         status;
     const char          *message;
 };
 
 struct msc_engine {
     apr_pool_t              *mp;
     apr_global_mutex_t      *auditlog_lock;
     apr_global_mutex_t      *geo_lock;
     msre_engine             *msre;
     unsigned int             processing_mode;
 };
 
 struct msc_data_chunk {
     char                    *data;
     apr_size_t               length;
     unsigned int             is_permanent;
 };
 
 struct msc_arg {
     const char              *name;
     unsigned int             name_len;
     unsigned int             name_origin_offset;
     unsigned int             name_origin_len;
     const char              *value;
diff -rpNU 30 ../modsecurity-apache_2.7.1-o/apache2/msc_xml.c ./apache2/msc_xml.c
--- ../modsecurity-apache_2.7.1-o/apache2/msc_xml.c	2012-11-14 03:25:56.000000000 +0100
+++ ./apache2/msc_xml.c	2013-04-05 16:08:14.000000000 +0200
@@ -1,57 +1,65 @@
 /*
 * ModSecurity for Apache 2.x, http://www.modsecurity.org/
 * Copyright (c) 2004-2011 Trustwave Holdings, Inc. (http://www.trustwave.com/)
 *
 * You may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * If any of the files related to licensing are missing or if you have any
 * other questions related to licensing please contact Trustwave Holdings, Inc.
 * directly using the email address security@modsecurity.org.
 */
 
 #include "msc_xml.h"
 
+static xmlParserInputBufferPtr xml_unload_external_entity(const char *URI, xmlCharEncoding enc) {
+    return NULL;
+}
 
 /**
  * Initialise XML parser.
  */
 int xml_init(modsec_rec *msr, char **error_msg) {
+    xmlParserInputBufferCreateFilenameFunc entity;
     if (error_msg == NULL) return -1;
     *error_msg = NULL;
 
     msr->xml = apr_pcalloc(msr->mp, sizeof(xml_data));
     if (msr->xml == NULL) return -1;
 
+    if(msr->txcfg->xml_external_entity == 0) {
+	entity = xmlParserInputBufferCreateFilenameDefault(xml_unload_external_entity);
+    }
+
     return 1;
 }
 
 #if 0
 static void xml_receive_sax_error(void *data, const char *msg, ...) {
     modsec_rec *msr = (modsec_rec *)data;
     char message[256];
 
     if (msr == NULL) return;
 
     apr_snprintf(message, sizeof(message), "%s (line %d offset %d)",
         log_escape_nq(msr->mp, msr->xml->parsing_ctx->lastError.message),
         msr->xml->parsing_ctx->lastError.line,
         msr->xml->parsing_ctx->lastError.int2);
 
     msr_log(msr, 5, "XML: Parsing error: %s", message);
 }
 #endif
 
 /**
  * Feed one chunk of data to the XML parser.
  */
 int xml_process_chunk(modsec_rec *msr, const char *buf, unsigned int size, char **error_msg) {
     if (error_msg == NULL) return -1;
     *error_msg = NULL;
 
     /* We want to initialise our parsing context here, to
      * enable us to pass it the first chunk of data so that
      * it can attempt to auto-detect the encoding.
      */
