Skip to content

LIBXML_XINCLUDE is not supported, should be documented #5003

@hannob

Description

@hannob

Affected page

https://www.php.net/manual/en/libxml.constants.php#constant.libxml-xinclude

Issue description

The PHP documentation mentions the LIBXML_XINCLUDE constant to enable XInclude support in XML parsing here:
https://www.php.net/manual/en/libxml.constants.php#constant.libxml-xinclude

However it does not appear to work. I am not entirely sure whether this is intentional (then it would be a documentation issue) or whether there's an expectation for it to work (then it should be considered a bug in the code).

I imagine it might be intentional, as Xinclude is a rarely used and potentially very dangerous feature, so I will report it here, assuming it should be properly documented.

Note that this has already been mentioned in a comment here a long time ago:
https://www.php.net/manual/en/function.simplexml-load-string.php#77713

Here's example code that should output the content of /etc/passwd (and does not do that):

#!/usr/bin/php
<?php

$xmlcontent = <<<EOF
<x xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/>
</x>
EOF;

$sx = new SimpleXMLElement($xmlcontent, LIBXML_XINCLUDE);

print($sx->asXML());


### Steps to reproduce

1. Go to
https://www.php.net/manual/en/libxml.constants.php#constant.libxml-xinclude
2. Try to write code using simplexml and that constant
3. does not include anything

### Suggested fix

Either documentation should mention that this is effectively unsupported and a NOOP or it should be supported (if so, please add a warning in the docs that it can be dangerous due to XXE attacks).

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugDocumentation contains incorrect information

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions