Fix #77686: Immediately remove ID from document when removing child

trowski · trowski · commit eb900c3b632d · 2021-05-03T18:33:09.000-05:00
Prior a removed node was still returned from DOMDocument::getElementById() until the DOMElement object was destroyed. Now null is returned from getElementById() even if a reference remains to the removed DOMElement object.
diff --git a/ext/dom/node.c b/ext/dom/node.c
@@ -925,6 +925,33 @@ static xmlNodePtr _php_dom_insert_fragment(xmlNodePtr nodep, xmlNodePtr prevsib,
 }
 /* }}} */
 
+void dom_node_remove_ids_from_doc(xmlNodePtr node) /* {{{ */
+{
+	xmlNodePtr child;
+	xmlAttrPtr attrp;
+
+	if (node->type == XML_DTD_NODE) {
+		return; // Skip DTD nodes, see bug #54601
+	}
+
+	child = node->children;
+	while (child) {
+		dom_node_remove_ids_from_doc(child);
+		child = child->next;
+	}
+
+	attrp = node->properties;
+	while (attrp) {
+		if (attrp->atype == XML_ATTRIBUTE_ID) {
+			xmlRemoveID(attrp->doc, attrp);
+			attrp->atype = 0;
+			break;
+		}
+		attrp = attrp->next;
+	}
+}
+/* }}} */
+
 /* {{{ proto domnode dom_node_insert_before(DomNode newChild, DomNode refChild);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-952280727
 Since:
@@ -1217,6 +1244,7 @@ PHP_FUNCTION(dom_node_remove_child)
 	while (children) {
 		if (children == child) {
 			xmlUnlinkNode(child);
+			dom_node_remove_ids_from_doc(child);
 			DOM_RET_OBJ(child, &ret, intern);
 			return;
 		}
diff --git a/ext/dom/tests/bug77686.phpt b/ext/dom/tests/bug77686.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #77686 Removed elements are still returned by getElementById
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+$doc = new DOMDocument;
+$doc->loadHTML('<html><body id="x"><div id="y"><span id="z"></span></div></body></html>');
+$body = $doc->getElementById('x');
+$div = $doc->getElementById('y');
+$span = $doc->getElementById('z');
+$body->removeChild($div);
+var_dump($doc->getElementById('y'));
+var_dump($doc->getElementById('z'));
+?>
+--EXPECT--
+NULL
+NULL
