Fix GH-15654: Signed integer overflow in ext/dom/nodelist.c

There's implicit truncation casts from zend_long to int which cause
issues because checks are done against the zend_longs. Sin

Fix GH-15654: Signed integer overflow in ext/dom/nodelist.c

There's implicit truncation casts from zend_long to int which cause
issues because checks are done against the zend_longs. Since the
iterator infrastructure uses zend_longs, just convert everything to
zend_long.

Closes GH-15669.

show more ...

Fix crashes when entity declaration is removed while still having entity references

libxml doesn't do reference counting inside its node types. It's
possible to remove an entity declarat

Fix crashes when entity declaration is removed while still having entity references

libxml doesn't do reference counting inside its node types. It's
possible to remove an entity declaration out of the document, but then
entity references will keep pointing to that stale declaration. This
will cause crashes.

One idea would be to check when a declaration is removed, to trigger a
hook that updates all references. However this means we have to keep
track of all references somehow, which would be a high-overhead
solution. The solution in this patch makes sure that the fields are
always updated before they are read.

Closes GH-14089.

show more ...

Fix reference access in dimensions for DOMNodeList and DOMNodeMap

Closes GH-13511.

Fix GH-12870: Creating an xmlns attribute results in a DOMException

There were multiple things here since forever, see the GH thread [1]
for discussion.

There were already many

Fix GH-12870: Creating an xmlns attribute results in a DOMException

There were multiple things here since forever, see the GH thread [1]
for discussion.

There were already many fixes to this function previously, and as a
consequence of one of those fixes this started throwing exceptions for a
correct use-case. It turns out that even when reverting to the previous
behaviour there are still bugs. Just fix all of them while we have the
chance.

[1] https://github.com/php/php-src/issues/12870

Closes GH-12888.

show more ...

Restore old namespace reconciliation behaviour

The xmlDOMWrapReconcileNamespaces method we used to fix the namespace
corruption issues in 8.1.21/8.2.8 caused regressions.
Primarily,

Restore old namespace reconciliation behaviour

The xmlDOMWrapReconcileNamespaces method we used to fix the namespace
corruption issues in 8.1.21/8.2.8 caused regressions.
Primarily, there is a similar corruption that the xmlReconciliateNs method
used to have in which a namespace is suddenly shifted
(SAML-Toolkits/php-saml#562) and the side-effect of removing redundant
namespaces causes problems when a specific serialization is required.

Closes GH-12308.

show more ...

Fix various namespace prefix conflict resolution bugs and namespace shift bugs

There are two linked issues:

- Conflicts couldn't be resolved by changing the prefix name.
- Lacki

Fix various namespace prefix conflict resolution bugs and namespace shift bugs

There are two linked issues:

- Conflicts couldn't be resolved by changing the prefix name.
- Lacking a prefix would shift the namespace as the default namespace,
causing elements to suddenly become part of the namespace instead of
the attributes.

The output could still be improved by removing redundant namespace
declarations, but that's another issue. At least the output is
correct now.

Closes GH-11777.

show more ...

Fix #80927: Removing documentElement after creating attribute node: possible use-after-free

Closes GH-11892.

Implement DOMNode::parentElement and DOMNameSpaceNode::parentElement

ref: https://dom.spec.whatwg.org/#parent-element

Closes GH-11679.

Implement DOMNode::isConnected and DOMNameSpaceNode::isConnected

ref: https://dom.spec.whatwg.org/#dom-node-isconnected

Closes GH-11677.

Implement DOMElement::id

ref: https://dom.spec.whatwg.org/#dom-element-id

Closes GH-11701.

Implement DOMElement::className

ref: https://dom.spec.whatwg.org/#dom-element-classname

Closes GH-11691.

Fix GH-9628: Implicitly removing nodes from \DOMDocument breaks existing references

Change the way lifetime works in ext/libxml and ext/dom

Previously, a node could be freed even wh

Fix GH-9628: Implicitly removing nodes from \DOMDocument breaks existing references

Change the way lifetime works in ext/libxml and ext/dom

Previously, a node could be freed even when holding a userland reference
to it. This resulted in exceptions when trying to access that node after
it has been implicitly or explicitly removed. After this patch, a node
will only be freed when the last userland reference disappears.

Fixes GH-9628.
Closes GH-11576.

show more ...

Remove always-false check

There are no prop handlers with a NULL key.

Avoid allocation when getting the node content, if possible

Closes GH-11543.

Two tiny ext/dom cleanups (#11541)

* Remove obsolete workaround code

This code was for libxml2 <= 2.6.14. PHP requires at least libxml2
2.9.0.

* Use an inline check ins

Two tiny ext/dom cleanups (#11541)

* Remove obsolete workaround code

This code was for libxml2 <= 2.6.14. PHP requires at least libxml2
2.9.0.

* Use an inline check instead of calling into the library for an empty string check

show more ...

Fix GH-11500: Namespace reuse in createElementNS() generates wrong output

When you construct a DOM tree containing subtrees which are constructed
top-down, this won't remove the redundan

Fix GH-11500: Namespace reuse in createElementNS() generates wrong output

When you construct a DOM tree containing subtrees which are constructed
top-down, this won't remove the redundant namespaces. That's because the
following conditions hold:
1) The namespace are reused from the doc->oldNs list.
2) Therefore during reconciliation no nsDef field is set, so no redundant
namespaces are removed by our reconciliation code.

Furthermore, it would only be fixed up automatically if the tree wasn't
added in bottom-up way, or if it had been constructed bottom-up from the
start.

Fix it by setting a flag to remove redundant namespaces in the libxml2
reconciliation call.
Since removing redundant namespaces may have a performance cost, we only do
this after performing a simple check.

Closes GH-11528.

show more ...

Revert "Fix GH-11404: DOMDocument::savexml and friends ommit xmlns="" declaration for null namespace, creating incorrect xml representation of the DOM"

This reverts commit 7eb3e9cd173fbdd39e

Revert "Fix GH-11404: DOMDocument::savexml and friends ommit xmlns="" declaration for null namespace, creating incorrect xml representation of the DOM"

This reverts commit 7eb3e9cd173fbdd39eefa791aab610858e76399d.

Although the fix follows the spec, it causes issues because a lot of old
code assumes the incorrect behaviour PHP had since a long time.
We cannot do this yet, especially not in a stable release.
We revert this for the time being.
See GH-11428.

show more ...

Fix #80332: Completely broken array access functionality with DOMNamedNodeMap

The problem is the usage of zval_get_long(). In particular, if the
string is non-numeric the result of zval_

Fix #80332: Completely broken array access functionality with DOMNamedNodeMap

The problem is the usage of zval_get_long(). In particular, if the
string is non-numeric the result of zval_get_long() will be 0 without
giving an error or warning. This is misleading for users: users get the
impression that they can use strings to access the map because it
coincidentally works for the first item (which is at index 0). Of
course, this fails with any other index which causes confusion and bugs.

This patch adds proper support for using string offsets while accessing
the map. It does so by detecting if it's a non-numeric string, and then
using the getNamedItem() method instead of item(). I had to split up the
array access implementation code for DOMNodeList and DOMNamedNodeMap
first to be able to do this.

Closes GH-11468.

show more ...

Fix GH-11404: DOMDocument::savexml and friends ommit xmlns="" declaration for null namespace, creating incorrect xml representation of the DOM

The NULL namespace is only correct when there i

Fix GH-11404: DOMDocument::savexml and friends ommit xmlns="" declaration for null namespace, creating incorrect xml representation of the DOM

The NULL namespace is only correct when there is no default namespace
override. When there is, we need to manually set it to the empty string
namespace.

Closes GH-11428.

show more ...

Fix bug #55294 and #47530 and #47847: namespace reconciliation issues

We'll use the DOM wrapper version of libxml2 instead of the regular one.
It's conforming to the behaviour we expect

Fix bug #55294 and #47530 and #47847: namespace reconciliation issues

We'll use the DOM wrapper version of libxml2 instead of the regular one.
It's conforming to the behaviour we expect of DOM.
Most of this patch is tests.

I based and extended the tests on the code attached with the aforementioned
bug reports. Therefore the credits for the tests:
Co-authored-by: hilse at web dot de
Co-authored-by: robin2008 at altruists dot org
Co-authored-by: sgunderson at bigfoot dot com

We'll also change the searching point of the internal reconciliation to
start at the top of the added tree to avoid redundant work now that the
function is changed.

Closes GH-11454.

show more ...

Fix "invalid state error" with cloned namespace declarations

Closes GH-11429.

Fix #70359 and #78577: segfaults with DOMNameSpaceNode

* Fix type confusion and parent reference
* Manually manage the lifetime of the parent
* Add regression tests
* Break out t

Fix #70359 and #78577: segfaults with DOMNameSpaceNode

* Fix type confusion and parent reference
* Manually manage the lifetime of the parent
* Add regression tests
* Break out to a helper, and apply the use-after-free fix to xpath

Closes GH-11402.

show more ...

Fix #79700: Bad performance with namespaced nodes due to wrong libxml assumption

* Use a prepending strategy instead of appending in dom_set_old_ns()

Looping to the end of the list

Fix #79700: Bad performance with namespaced nodes due to wrong libxml assumption

* Use a prepending strategy instead of appending in dom_set_old_ns()

Looping to the end of the list is wasteful. We can just put the new
nodes at the front of the list. I don't believe we can fully prepend,
because libxml2 may assume that the xml namespace is the first one, so
we'll put the new ones as the second one.

* Reuse namespaces from doc->oldNs if possible in dom_get_ns()

* Add a test for reconciling a reused namespace

* Explain why there can't be a cycle between oldNs and nsDef

Closes GH-11376.

Also fixes #77894.

show more ...

Factor out dom_remove_all_children()

A few callers remove all children of a node. The way it was done in
node.c was unsafe, because it left nodep->last dangling. It just happens
to n

Factor out dom_remove_all_children()

A few callers remove all children of a node. The way it was done in
node.c was unsafe, because it left nodep->last dangling. It just happens
to not crash if xmlNodeSetContent() is called immediately afterwards.

show more ...

Fix bug #67440: append_node of a DOMDocumentFragment does not reconcile namespaces

The test was amended from the original issue report. For the test:
Co-authored-by: php@deep-freeze.ca

Fix bug #67440: append_node of a DOMDocumentFragment does not reconcile namespaces

The test was amended from the original issue report. For the test:
Co-authored-by: php@deep-freeze.ca

The problem is that the regular dom_reconcile_ns() only works on a
single node. We actually have to reconciliate the whole tree in case a
fragment was added. This also required to move some code around such
that this special case could be handled separately.

Closes GH-11362.

show more ...