Sanitize libxml2 globals before parsing

Fixes GHSA-3qrf-m4j2-pcrr.

To parse a document with libxml2, you first need to create a parsing context.
The parsing context contains par

Sanitize libxml2 globals before parsing

Fixes GHSA-3qrf-m4j2-pcrr.

To parse a document with libxml2, you first need to create a parsing context.
The parsing context contains parsing options (e.g. XML_NOENT to substitute
entities) that the application (in this case PHP) can set.
Unfortunately, libxml2 also supports providing default set options.
For example, if you call xmlSubstituteEntitiesDefault(1) then the XML_NOENT
option will be added to the parsing options every time you create a parsing
context **even if the application never requested XML_NOENT**.

Third party extensions can override these globals, in particular the
substitute entity global. This causes entity substitution to be
unexpectedly active.

Fix it by setting the parsing options to a sane known value.
For API calls that depend on global state we introduce
PHP_LIBXML_SANITIZE_GLOBALS() and PHP_LIBXML_RESTORE_GLOBALS().
For other APIs that work directly with a context we introduce
php_libxml_sanitize_parse_ctxt_options().

show more ...

Fix array overrun when appending slash to paths

Fix it by extending the array sizes by one character. As the input is
limited to the maximum path length, there will always be place to ap

Fix array overrun when appending slash to paths

Fix it by extending the array sizes by one character. As the input is
limited to the maximum path length, there will always be place to append
the slash. As the php_check_specific_open_basedir() simply uses the
strings to compare against each other, no new failures related to too
long paths are introduced.
We'll let the DOM and XML case handle a potentially too long path in the
library code.

show more ...

Make getElementsByTagNameNS $namespace nullable

According to the DOM specification, this argument is supposed to
be nullable.

Fix #80268: loadHTML() truncates at NUL bytes

libxml2 has no particular issues parsing HTML strings with NUL bytes;
these just cause truncation of the current text content, but parsing

Fix #80268: loadHTML() truncates at NUL bytes

libxml2 has no particular issues parsing HTML strings with NUL bytes;
these just cause truncation of the current text content, but parsing
continues generally. Since `::loadHTMLFile()` already supports NUL
bytes, `::loadHTML()` should as well.

Note that this is different from XML, which does not allow any NUL
bytes.

Closes GH-6368.

show more ...

Make handling of NULL bytes in file paths more consistent (WIP)

Not all extensions consistently throw exceptions when the user passes
a path name containing null bytes. Also, some extens

Make handling of NULL bytes in file paths more consistent (WIP)

Not all extensions consistently throw exceptions when the user passes
a path name containing null bytes. Also, some extensions would throw
a ValueError while others would throw a TypeError. Error messages
also varied.

Now a ValueError is thrown after all failed path checks, at least for
as far as these occur in functions that are exposed to userland.

Closes GH-6216.

show more ...

Fix a few ZEND_UNREACHABLE() calls

Promote warnings to error in DOM extension

Closes GH-5418

Review the usage of apostrophes in error messages

Closes GH-5590

Remove proto comments from C files

Closes GH-5758

Don't throw warning if exception thrown during dom validation

Fix invalid usage of zend_bool in DOM extension

Fix [-Wundef] warning in DOM extension

Improve a last couple of argument error messages

Closes GH-5404

Generate method entries for ext/dom

Closes GH-5374

Do not include the same stub multiple times

Closes GH-5322

[RFC] Implement new DOM Living Standard APIs in ext/dom

Rename php_dom_create_interator() to php_dom_create_iterator()

Thus fixing an obvious typo.

Fix #77569: Write Acess Violation in DomImplementation

We must not assume that the zval IS_STRING.

Use RETURN_THROWS() after zend_throw_error()

Use RETURN_THROWS() during ZPP in the date, dba and dom extensions

ext/dom: Replace usages of PHP_FUNCTION and aliases with PHP_METHOD.

Convert ext/dom to use arginfo stub.

zend_parse_parameters_throw() is obsolete

Since `zend_parse_parameters()` throws now, there is no reason to
explicitly call `zend_parse_parameters_throw()` anymore, and since both
ha

zend_parse_parameters_throw() is obsolete

Since `zend_parse_parameters()` throws now, there is no reason to
explicitly call `zend_parse_parameters_throw()` anymore, and since both
have actually the same implementation, we redefine the latter as macro.

show more ...

Small ext/dom cleanups

Fix number of required arguments in arginfo

* pack() only requires one argument
* stream_context_set_option() only requires two arguments
* ReflectionMethod::getClosure() accepts no

Fix number of required arguments in arginfo

* pack() only requires one argument
* stream_context_set_option() only requires two arguments
* ReflectionMethod::getClosure() accepts no args for static methods
* DOMDocument::createProcessingInstruction() only requires one arg
* DOMImplementation::createDocument() only requires two arguments
* DOMDocument::importNode() only requires one arg
* mysql_get_client_version() doesn't accept any args,
despite what the docs say...

show more ...