Sanitize libxml2 globals before parsing

Fixes GHSA-3qrf-m4j2-pcrr.

To parse a document with libxml2, you first need to create a parsing context.
The parsing context contains par

Sanitize libxml2 globals before parsing

Fixes GHSA-3qrf-m4j2-pcrr.

To parse a document with libxml2, you first need to create a parsing context.
The parsing context contains parsing options (e.g. XML_NOENT to substitute
entities) that the application (in this case PHP) can set.
Unfortunately, libxml2 also supports providing default set options.
For example, if you call xmlSubstituteEntitiesDefault(1) then the XML_NOENT
option will be added to the parsing options every time you create a parsing
context **even if the application never requested XML_NOENT**.

Third party extensions can override these globals, in particular the
substitute entity global. This causes entity substitution to be
unexpectedly active.

Fix it by setting the parsing options to a sane known value.
For API calls that depend on global state we introduce
PHP_LIBXML_SANITIZE_GLOBALS() and PHP_LIBXML_RESTORE_GLOBALS().
For other APIs that work directly with a context we introduce
php_libxml_sanitize_parse_ctxt_options().

show more ...

Fix bug #81325 Segfault in zif_simplexml_import_dom

Revert "Fix #80852: Stack-overflow when json_encode()'ing SimpleXMLElement"

Sorry, this solution seems to have BC breaks, will need to look
for better one.

This reverts commit 9

Revert "Fix #80852: Stack-overflow when json_encode()'ing SimpleXMLElement"

Sorry, this solution seems to have BC breaks, will need to look
for better one.

This reverts commit 9f7e8b777cb3e8aac53e677f3152af18413ab672.

show more ...

Fix #80852: Stack-overflow when json_encode()'ing SimpleXMLElement

We ignore `XML_ENTITY_DECL` nodes when getting the hash of the
properties of a `SimpleXMLElement`.

Fix arginfo/ZPP mismatch for simplexml_import_dom

Closes GH-6905

Fix UNKNOWN default values in various extensions

Closes GH-6075

Promote warnings to exceptions in ext/simplexml

Closes GH-6011

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>

Don't return temporary from SXE write_property handler

Return the original value. If we don't return the original value,
we need to own the zval, which we don't.

For clarity als

Don't return temporary from SXE write_property handler

Return the original value. If we don't return the original value,
we need to own the zval, which we don't.

For clarity also switch things to work on a zend_string* value
instead of a zval*.

show more ...

Simplify change_node_zval implementation

At this point, the value has already been converted into a string.

Add a missing null check in simplexml

Throw on uninitialized SimpleXMLElement

Elevate this warning into an Error, as usual. Add a few checks
in places that were missing them.

Remove proto comments from C files

Closes GH-5758

Add get_gc handle for object iterators

Optional handler with the same semantics as the object handler.

Make SimpleXMLElement a RecursiveIterator

Context: https://externals.io/message/108789

This essentially moves the functionality of SimpleXMLIterator into
SimpleXMLElement, and m

Make SimpleXMLElement a RecursiveIterator

Context: https://externals.io/message/108789

This essentially moves the functionality of SimpleXMLIterator into
SimpleXMLElement, and makes SimpleXMLIterator a no-op extension.

Ideally SimpleXMLElement would be an IteratorAggregate, whose
getIterator() method returns SimpleXMLIterator. However, because
SimpleXMLIterator extends SimpleXMLElement (and code depends on
this in non-trivial ways), this is not possible.

The only way to not keep SimpleXMLElement as a magic Traversable
(that implements neither Iterator nor IteratorAggregate) is to
move the SimpleXMLIterator functionality into it.

Closes GH-5234.

show more ...

Fix #63575: Root elements are not properly cloned

Cloning of root elements has to preserve that property, so they require
some special treatment.

Add ZVAL_OBJ_COPY macro

For the common ZVAL_OBJ + GC_ADDREF pattern.
This mirrors the existing ZVAL_STR_COPY API.

Fix warning of strict-prototypes

Closes GH-5673.

Fix [-Wundef] warning in SimpleXML extension

Fix #79528: Different object of the same xml between 7.4.5 and 7.4.4

Revert "Fix #61597: SXE properties may lack attributes and content"

This reverts commit 7c081db885756d7b176a55b9

Fix #79528: Different object of the same xml between 7.4.5 and 7.4.4

Revert "Fix #61597: SXE properties may lack attributes and content"

This reverts commit 7c081db885756d7b176a55b90b8746f664d1e042.

show more ...

Generate function entries from stubs

Converts ext/pcntl, ext/simplexml, ext/snmp, ext/soap, ext/sqlite3.
Closes GH-5421

Clarify SimpleXML comparison logic

Add a ZEND_UNCOMPARABLE value

To explicitly indicate that objects are uncomparable. For now
this has no functional difference from the usual 1 return value,
but makes intent clearer.

Improve error messages of various extensions

Closes GH-5278

Fix #61597: SXE properties may lack attributes and content

We must not treat a node as string if it has attributes, unless it is
an entity declaration which is always treated as string b

Fix #61597: SXE properties may lack attributes and content

We must not treat a node as string if it has attributes, unless it is
an entity declaration which is always treated as string by simplexml.

show more ...

Define Stringable with __toString():string method