Skip to content

Commit 2845f85

Browse files
committed
Fix #30875: xml_parse_into_struct() does not resolve entities
Setting up an empty default handler is not only useless, but actually harmful, since internal entity-references are not resolved anymore. From the libexpat docs[1]: | Setting the handler with this call has the side effect of | turning off expansion of references to internally defined general | entities. Instead these references are passed to the default | handler. [1] <https://www.xml.com/pub/1999/09/expat/reference.html#setdefhandler>
1 parent f42d7bd commit 2845f85

File tree

3 files changed

+45
-1
lines changed

3 files changed

+45
-1
lines changed

NEWS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ PHP NEWS
2626
. Fixed bug #76965 (INI_SCANNER_RAW doesn't strip trailing whitespace).
2727
(Pierrick)
2828

29+
- XML:
30+
. Fixed bug #30875 (xml_parse_into_struct() does not resolve entities). (cmb)
31+
2932
11 Oct 2018, PHP 7.1.23
3033

3134
- Core:

ext/xml/tests/bug30875.phpt

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
--TEST--
2+
Bug #30875 (xml_parse_into_struct() does not resolve entities)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('xml')) die('skip xml extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
10+
$xml = <<<XML
11+
<!DOCTYPE dtd [
12+
<!ENTITY ref "ent">
13+
]>
14+
<elt att="&ref;">a&ref;</elt>
15+
XML;
16+
17+
$parser = xml_parser_create();
18+
xml_parse_into_struct($parser, $xml, $vals);
19+
xml_parser_free($parser);
20+
var_dump($vals);
21+
?>
22+
===DONE===
23+
--EXPECT--
24+
array(1) {
25+
[0]=>
26+
array(5) {
27+
["tag"]=>
28+
string(3) "ELT"
29+
["type"]=>
30+
string(8) "complete"
31+
["level"]=>
32+
int(1)
33+
["attributes"]=>
34+
array(1) {
35+
["ATT"]=>
36+
string(3) "ent"
37+
}
38+
["value"]=>
39+
string(4) "aent"
40+
}
41+
}
42+
===DONE===

ext/xml/xml.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1447,7 +1447,6 @@ PHP_FUNCTION(xml_parse_into_struct)
14471447
parser->level = 0;
14481448
parser->ltags = safe_emalloc(XML_MAXLEVEL, sizeof(char *), 0);
14491449

1450-
XML_SetDefaultHandler(parser->parser, _xml_defaultHandler);
14511450
XML_SetElementHandler(parser->parser, _xml_startElementHandler, _xml_endElementHandler);
14521451
XML_SetCharacterDataHandler(parser->parser, _xml_characterDataHandler);
14531452

0 commit comments

Comments
 (0)