Support stream wrappers in XML parser extensions, add external entity loader

[swtaarrs]

Summary:

• Support stream wrappers in SimpleXML, DOM and XMLReader input and
  output filenames.
• Rename libxml_input_buffer() to libxml_create_input_buffer().
• Implement userspace function libxml_set_streams_context(), was
  previously missing.
• Since the VM can now be re-entered during parsing, with libxml2 in the
  call stack with -fomit-frame-pointer, all XML parsing functions must
  be protected with SYNC_VM_REGS_SCOPED().
• In DOMDocument, don't do File::TranslatePath() on input filenames,
  since they can now be URLs, and translation is now redundant with that
  done by FileStreamWrapper.
• In simplexml_load_file(), call xmlReadFile() instead of
  f_file_get_contents(), so that the libxml default stream context is
  used. Almost fixes test/zend/bad/ext/libxml/tests/bug54440.php, except
  for a minor error handling issue that should be dealt with by GitHub
  PR Add an XML external entity loader. #2376.
• In stream_context_create(), return a default stream context resource
  when the options fail validation, instead of returning false. This
  matches the PHP behaviour and makes
  hphp/test/zend/bad/ext/libxml/tests/bug63389.php pass.
• Move passing tests to hphp/test/zend/good
• Add test.xml, copied from PHP 5.6.0-dev, needed by a passing test.
• Add an external entity loader. This allows the use of "data:" and
  "compress.zlib:" in entities and URIs.

Since loading external entities exposes a number of security issues including
remote shell execution, it's disabled by default (except for the data: protocol
which isn't actually external). The new config option is documented in
doc/inconsistencies.

Submitted on behalf of a third-party: The PHP Group
Source: PHP 5.6.0-dev
License: version 3.01 of the PHP license

Closes: #2329
Closes: #2829

Test Plan: automated tests, new version of zend test to make sure external
entity loading fails by default

[facebook-github-bot]

This pull request has been imported into Phabricator, and discussion and review of the diff will take place at https://reviews.facebook.net/D20373

[swtaarrs]

@ptarjan is the review supposed to update automatically when I push my branch or do I have to comment here? My other PR, #3219, seems to be updating just fine.

[ptarjan]

@swtaarrs yes, I'm not sure why it didn't import your diff... digging... (and I'll force this one by hand)

[ptarjan]

@swtaarrs what parts of swtaarrs@efae335 aren't on https://reviews.facebook.net/D20373 ? It looks like you authored it 7 days ago. Which push are you expecting to update there?

[swtaarrs]

https://reviews.facebook.net/D20373#36