Skip to content

Commit

Permalink
Fix #30875: xml_parse_into_struct() does not resolve entities
Browse files Browse the repository at this point in the history
Setting up an empty default handler is not only useless, but actually
harmful, since internal entity-references are not resolved anymore.
From the libexpat docs[1]:

| Setting the handler with this call has the side effect of
| turning off expansion of references to internally defined general
| entities. Instead these references are passed to the default
| handler.

[1] <https://www.xml.com/pub/1999/09/expat/reference.html#setdefhandler>
  • Loading branch information
cmb69 committed Oct 9, 2018
1 parent f42d7bd commit 2845f85
Show file tree
Hide file tree
Showing 3 changed files with 45 additions and 1 deletion.
3 changes: 3 additions & 0 deletions NEWS
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,9 @@ PHP NEWS
. Fixed bug #76965 (INI_SCANNER_RAW doesn't strip trailing whitespace).
(Pierrick)

- XML:
. Fixed bug #30875 (xml_parse_into_struct() does not resolve entities). (cmb)

11 Oct 2018, PHP 7.1.23

- Core:
Expand Down
42 changes: 42 additions & 0 deletions ext/xml/tests/bug30875.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
--TEST--
Bug #30875 (xml_parse_into_struct() does not resolve entities)
--SKIPIF--
<?php
if (!extension_loaded('xml')) die('skip xml extension not available');
?>
--FILE--
<?php

$xml = <<<XML
<!DOCTYPE dtd [
<!ENTITY ref "ent">
]>
<elt att="&ref;">a&ref;</elt>
XML;

$parser = xml_parser_create();
xml_parse_into_struct($parser, $xml, $vals);
xml_parser_free($parser);
var_dump($vals);
?>
===DONE===
--EXPECT--
array(1) {
[0]=>
array(5) {
["tag"]=>
string(3) "ELT"
["type"]=>
string(8) "complete"
["level"]=>
int(1)
["attributes"]=>
array(1) {
["ATT"]=>
string(3) "ent"
}
["value"]=>
string(4) "aent"
}
}
===DONE===
1 change: 0 additions & 1 deletion ext/xml/xml.c
Original file line number Diff line number Diff line change
Expand Up @@ -1447,7 +1447,6 @@ PHP_FUNCTION(xml_parse_into_struct)
parser->level = 0;
parser->ltags = safe_emalloc(XML_MAXLEVEL, sizeof(char *), 0);

XML_SetDefaultHandler(parser->parser, _xml_defaultHandler);
XML_SetElementHandler(parser->parser, _xml_startElementHandler, _xml_endElementHandler);
XML_SetCharacterDataHandler(parser->parser, _xml_characterDataHandler);

Expand Down

0 comments on commit 2845f85

Please sign in to comment.