Fix GH-21486: Dom\HTMLDocument parser mangles xml:space and xml:lang attributes

Closes GH-21489.

Author: ndossche

NEWS

@@ -9,6 +9,10 @@ PHP                                                                        NEWS
   . Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in
     get_property_ptr_ptr for lazy proxies). (iliaal)
 
+- DOM:
+  . Fixed bug GH-21486 (Dom\HTMLDocument parser mangles xml:space and
+    xml:lang attributes). (ndossche)
+
 - GD:
   . Fixed bug GH-21431 (phpinfo() to display libJPEG 10.0 support).
     (David Carlier)

ext/dom/html5_parser.c

@@ -117,6 +117,7 @@ static lexbor_libxml2_bridge_status lexbor_libxml2_bridge_convert(
 	php_dom_libxml_ns_mapper *ns_mapper = php_dom_ns_mapper_from_private(private_data);
     xmlNsPtr html_ns = php_dom_libxml_ns_mapper_ensure_html_ns(ns_mapper);
     xmlNsPtr xlink_ns = NULL;
+    xmlNsPtr xml_ns = NULL;
     xmlNsPtr prefixed_xmlns_ns = NULL;
 
     lexbor_array_obj_t work_list;
@@ -256,6 +257,12 @@ static lexbor_libxml2_bridge_status lexbor_libxml2_bridge_convert(
                         xlink_ns->_private = (void *) php_dom_ns_is_xlink_magic_token;
                     }
                     lxml_attr->ns = xlink_ns;
+                } else if (attr->node.ns == LXB_NS_XML) {
+                    if (xml_ns == NULL) {
+                        xml_ns = php_dom_libxml_ns_mapper_get_ns_raw_strings_nullsafe(ns_mapper, "xml", DOM_XML_NS_URI);
+                        xml_ns->_private = (void *) php_dom_ns_is_xml_magic_token;
+                    }
+                    lxml_attr->ns = xml_ns;
                 }
 
                 if (last_added_attr == NULL) {

ext/dom/tests/modern/html/parser/gh21486.phpt

@@ -0,0 +1,18 @@
+--TEST--
+GH-21486 (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes)
+--EXTENSIONS--
+dom
+--CREDITS--
+JKingweb
+--FILE--
+<?php
+$d = @\Dom\HTMLDocument::createFromString("<div></div>");
+$e = $d->getElementsByTagName("div")[0];
+$e->innerHTML = '<svg xml:space="default" xlink:href="about:blank" xmlns:foo="barspace"></svg>';
+$svg = $d->querySelector("svg");
+echo $e->innerHTML."\n";
+echo $svg->attributes[0]->localName." ".var_export($svg->attributes[0]->namespaceURI, true)."\n";
+?>
+--EXPECT--
+<svg xml:space="default" xlink:href="about:blank" xmlns:foo="barspace"></svg>
+space 'http://www.w3.org/XML/1998/namespace'