#
9cb23a3d |
| 30-Aug-2024 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix GH-15654: Signed integer overflow in ext/dom/nodelist.c There's implicit truncation casts from zend_long to int which cause issues because checks are done against the zend_longs. Sin
Fix GH-15654: Signed integer overflow in ext/dom/nodelist.c There's implicit truncation casts from zend_long to int which cause issues because checks are done against the zend_longs. Since the iterator infrastructure uses zend_longs, just convert everything to zend_long. Closes GH-15669.
show more ...
|
#
b282dd74 |
| 28-Jul-2024 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix UAF when removing doctype and using foreach iteration This is an old bug, but this is pretty easy to fix. It's basically applying the same fix as I did for e878b9f. Reported by Y
Fix UAF when removing doctype and using foreach iteration This is an old bug, but this is pretty easy to fix. It's basically applying the same fix as I did for e878b9f. Reported by YuanchengJiang. Closes GH-15143.
show more ...
|
#
e878b9f3 |
| 30-Apr-2024 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix crashes when entity declaration is removed while still having entity references libxml doesn't do reference counting inside its node types. It's possible to remove an entity declarat
Fix crashes when entity declaration is removed while still having entity references libxml doesn't do reference counting inside its node types. It's possible to remove an entity declaration out of the document, but then entity references will keep pointing to that stale declaration. This will cause crashes. One idea would be to check when a declaration is removed, to trigger a hook that updates all references. However this means we have to keep track of all references somehow, which would be a high-overhead solution. The solution in this patch makes sure that the fields are always updated before they are read. Closes GH-14089.
show more ...
|
#
e658f805 |
| 06-Dec-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix GH-12870: Creating an xmlns attribute results in a DOMException There were multiple things here since forever, see the GH thread [1] for discussion. There were already many
Fix GH-12870: Creating an xmlns attribute results in a DOMException There were multiple things here since forever, see the GH thread [1] for discussion. There were already many fixes to this function previously, and as a consequence of one of those fixes this started throwing exceptions for a correct use-case. It turns out that even when reverting to the previous behaviour there are still bugs. Just fix all of them while we have the chance. [1] https://github.com/php/php-src/issues/12870 Closes GH-12888.
show more ...
|
#
eebc528c |
| 01-Oct-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix broken cache invalidation with deallocated and reallocated document node The original caching implementation had an oversight in combination with the new lifetime management in DOM f
Fix broken cache invalidation with deallocated and reallocated document node The original caching implementation had an oversight in combination with the new lifetime management in DOM for 8.3. The modification counter is stored on the document object itself, but as that can get deallocated when all references disappear, stale cache data can be used. Normally this isn't a problem, unless getElementsByTagName is called not on the document but on a child node. Fix it by moving caching data into the ref object, which will outlive all nodes from a document even if the document object disappears. Closes GH-12338.
show more ...
|
#
d46dc569 |
| 23-Jul-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix various namespace prefix conflict resolution bugs and namespace shift bugs There are two linked issues: - Conflicts couldn't be resolved by changing the prefix name. - Lacki
Fix various namespace prefix conflict resolution bugs and namespace shift bugs There are two linked issues: - Conflicts couldn't be resolved by changing the prefix name. - Lacking a prefix would shift the namespace as the default namespace, causing elements to suddenly become part of the namespace instead of the attributes. The output could still be improved by removing redundant namespace declarations, but that's another issue. At least the output is correct now. Closes GH-11777.
show more ...
|
#
bb092ab4 |
| 06-Aug-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix #80927: Removing documentElement after creating attribute node: possible use-after-free Closes GH-11892.
|
#
a73f38f4 |
| 17-Jul-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Implement DOMElement::insertAdjacent{Element,Text} (#11700) * Implement DOMElement::insertAdjacent{Element,Text} ref: https://dom.spec.whatwg.org/#dom-element-insertadjacentelement
Implement DOMElement::insertAdjacent{Element,Text} (#11700) * Implement DOMElement::insertAdjacent{Element,Text} ref: https://dom.spec.whatwg.org/#dom-element-insertadjacentelement ref: https://dom.spec.whatwg.org/#dom-element-insertadjacenttext Closes GH-11700.
show more ...
|
#
d38cc9b9 |
| 11-Jul-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Implement DOMNode::isConnected and DOMNameSpaceNode::isConnected ref: https://dom.spec.whatwg.org/#dom-node-isconnected Closes GH-11677.
|
#
6560c9bf |
| 13-Jul-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Implement DOMParentNode::replaceChildren() ref: https://dom.spec.whatwg.org/#dom-parentnode-replacechildren
|
#
b3899eb5 |
| 12-Jul-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Refactor dom_node_node_name_read() to avoid double allocation We will use this helper later outside of the node name read handler.
|
#
87e7b61d |
| 02-Jul-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Cleanup macro usage in ext/dom and ext/libxml With the new lifetime system in place, we can simplify some macros.
|
#
941a7e59 |
| 26-Jun-2023 |
nielsdos <7771979+nielsdos@users.noreply.github.com> |
Avoid allocation when getting the node content, if possible Closes GH-11543.
|
#
9f7d8880 |
| 17-Jun-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix #80332: Completely broken array access functionality with DOMNamedNodeMap The problem is the usage of zval_get_long(). In particular, if the string is non-numeric the result of zval_
Fix #80332: Completely broken array access functionality with DOMNamedNodeMap The problem is the usage of zval_get_long(). In particular, if the string is non-numeric the result of zval_get_long() will be 0 without giving an error or warning. This is misleading for users: users get the impression that they can use strings to access the map because it coincidentally works for the first item (which is at index 0). Of course, this fails with any other index which causes confusion and bugs. This patch adds proper support for using string offsets while accessing the map. It does so by detecting if it's a non-numeric string, and then using the getNamedItem() method instead of item(). I had to split up the array access implementation code for DOMNodeList and DOMNamedNodeMap first to be able to do this. Closes GH-11468.
show more ...
|
#
f2d673fb |
| 08-Jun-2023 |
nielsdos <7771979+nielsdos@users.noreply.github.com> |
Fix #70359 and #78577: segfaults with DOMNameSpaceNode * Fix type confusion and parent reference * Manually manage the lifetime of the parent * Add regression tests * Break out t
Fix #70359 and #78577: segfaults with DOMNameSpaceNode * Fix type confusion and parent reference * Manually manage the lifetime of the parent * Add regression tests * Break out to a helper, and apply the use-after-free fix to xpath Closes GH-11402.
show more ...
|
#
74910b14 |
| 22-Dec-2022 |
Tim Starling |
Factor out dom_remove_all_children() A few callers remove all children of a node. The way it was done in node.c was unsafe, because it left nodep->last dangling. It just happens to n
Factor out dom_remove_all_children() A few callers remove all children of a node. The way it was done in node.c was unsafe, because it left nodep->last dangling. It just happens to not crash if xmlNodeSetContent() is called immediately afterwards.
show more ...
|
#
a7202682 |
| 05-Jun-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Use uint32_t for the number of nodes (#11371)
|
#
23f70025 |
| 03-Jun-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix bug #81642: DOMChildNode::replaceWith() bug when replacing a node with itself Closes GH-11363.
|
#
b1d8e240 |
| 03-Jun-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Fix bug #67440: append_node of a DOMDocumentFragment does not reconcile namespaces The test was amended from the original issue report. For the test: Co-authored-by: php@deep-freeze.ca
Fix bug #67440: append_node of a DOMDocumentFragment does not reconcile namespaces The test was amended from the original issue report. For the test: Co-authored-by: php@deep-freeze.ca The problem is that the regular dom_reconcile_ns() only works on a single node. We actually have to reconciliate the whole tree in case a fragment was added. This also required to move some code around such that this special case could be handled separately. Closes GH-11362.
show more ...
|
#
c3f07973 |
| 02-Jun-2023 |
Niels Dossche <7771979+nielsdos@users.noreply.github.com> |
Implement iteration cache, item cache and length cache for node list iteration (#11330) * Implement iteration cache, item cache and length cache for node list iteration The current
Implement iteration cache, item cache and length cache for node list iteration (#11330) * Implement iteration cache, item cache and length cache for node list iteration The current implementation follows the spec requirement that the list must be "live". This means that changes in the document must be reflected in the existing node lists without requiring the user to refetch the node list. The consequence is that getting any item, or the length of the list, always starts searching from the root element of the node list. This results in O(n) time to get any item or the length. If there's a for loop over the node list, this means the iterations will take O(n²) time in total. This causes real-world performance issues with potential for downtime (see GH-11308 and its references for details). We fix this by introducing a caching strategy. We cache the last iterated object in the iterator, the last requested item in the node list, and the last length computation. To invalidate the cache, we simply count the number of modifications made to the containing document. If the modification number does not match what the number was during caching, we know the document has been modified and the cache is invalid. If this ever overflows, we saturate the modification number and don't do any caching anymore. Note that we don't check for overflow on 64-bit systems because it would take hundreds of years to overflow. Fixes GH-11308.
show more ...
|
#
c6655fb7 |
| 29-May-2023 |
nielsdos <7771979+nielsdos@users.noreply.github.com> |
Implement dom_get_doc_props_read_only() I was surprised to see that getting the stricterror property showed in in the Callgrind profile of some tests. Turns out we sometimes allocate
Implement dom_get_doc_props_read_only() I was surprised to see that getting the stricterror property showed in in the Callgrind profile of some tests. Turns out we sometimes allocate them. Fix this by returning the default in case no changes were made yet. Closes GH-11345.
show more ...
|
Revision tags: php-8.2.0RC1, php-8.1.10, php-8.0.23, php-8.0.23RC1, php-8.1.10RC1, php-8.2.0beta3, php-8.2.0beta2, php-8.1.9, php-8.0.22, php-8.1.9RC1, php-8.2.0beta1, php-8.0.22RC1, php-8.0.21, php-8.1.8, php-8.2.0alpha3, php-8.1.8RC1, php-8.2.0alpha2, php-8.0.21RC1, php-8.0.20, php-8.1.7, php-8.2.0alpha1, php-7.4.30, php-8.1.7RC1, php-8.0.20RC1, php-8.1.6, php-8.0.19, php-8.1.6RC1, php-8.0.19RC1, php-8.0.18, php-8.1.5, php-7.4.29, php-8.1.5RC1, php-8.0.18RC1, php-8.1.4, php-8.0.17, php-8.1.4RC1, php-8.0.17RC1, php-8.1.3, php-8.0.16, php-7.4.28, php-8.1.3RC1, php-8.0.16RC1, php-8.1.2, php-8.0.15, php-8.1.2RC1, php-8.0.15RC1, php-8.0.14, php-8.1.1, php-7.4.27, php-8.1.1RC1, php-8.0.14RC1, php-7.4.27RC1, php-8.1.0, php-8.0.13, php-7.4.26, php-7.3.33, php-8.1.0RC6, php-7.4.26RC1, php-8.0.13RC1, php-8.1.0RC5, php-7.3.32, php-7.4.25, php-8.0.12, php-8.1.0RC4, php-8.0.12RC1, php-7.4.25RC1, php-8.1.0RC3, php-8.0.11, php-7.4.24, php-7.3.31, php-8.1.0RC2, php-7.4.24RC1, php-8.0.11RC1, php-8.1.0RC1, php-7.4.23, php-8.0.10, php-7.3.30, php-8.1.0beta3, php-8.0.10RC1, php-7.4.23RC1, php-8.1.0beta2, php-8.0.9, php-7.4.22, php-8.1.0beta1, php-7.4.22RC1, php-8.0.9RC1, php-8.1.0alpha3, php-7.4.21, php-7.3.29, php-8.0.8, php-8.1.0alpha2, php-7.4.21RC1, php-8.0.8RC1, php-8.1.0alpha1, php-8.0.7, php-7.4.20, php-8.0.7RC1, php-7.4.20RC1 |
|
#
01b3fc03 |
| 06-May-2021 |
KsaR |
Update http->https in license (#6945) 1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https. 2. Update few license 3.0 to 3.01 as
Update http->https in license (#6945) 1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https. 2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier". 3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted. 4. fixed indentation in some files before |
show more ...
|
Revision tags: php-8.0.6, php-7.4.19, php-7.4.18, php-7.3.28, php-8.0.5, php-8.0.5RC1, php-7.4.18RC1 |
|
#
d842bc7e |
| 09-Apr-2021 |
George Peter Banyard |
Refactor dom_has_feature() to use zend_string*
|
Revision tags: php-8.0.4RC1, php-7.4.17RC1, php-8.0.3, php-7.4.16, php-8.0.3RC1 |
|
#
4c6533c2 |
| 17-Feb-2021 |
Máté Kocsis |
Generate class entries from stubs for com, standard, xmlreader, xmlwriter, xsl, zip, Zend Closes GH-6706
|
Revision tags: php-7.4.16RC1, php-8.0.2, php-7.4.15, php-7.3.27, php-8.0.2RC1, php-7.4.15RC2, php-7.4.15RC1, php-8.0.1, php-7.4.14, php-7.3.26, php-7.4.14RC1, php-8.0.1RC1, php-7.3.26RC1, php-8.0.0, php-7.3.25, php-7.4.13, php-8.0.0RC5, php-7.4.13RC1, php-8.0.0RC4, php-7.3.25RC1, php-7.4.12, php-8.0.0RC3, php-7.3.24, php-8.0.0RC2, php-7.4.12RC1, php-7.3.24RC1, php-7.2.34, php-8.0.0rc1, php-7.4.11, php-7.3.23, php-8.0.0beta4, php-7.4.11RC1, php-7.3.23RC1, php-8.0.0beta3, php-7.4.10, php-7.3.22, php-8.0.0beta2, php-7.3.22RC1, php-7.4.10RC1, php-8.0.0beta1, php-7.4.9, php-7.2.33, php-7.3.21, php-8.0.0alpha3, php-7.4.9RC1, php-7.3.21RC1, php-7.4.8, php-7.2.32, php-8.0.0alpha2, php-7.3.20, php-8.0.0alpha1, php-7.4.8RC1, php-7.3.20RC1, php-7.4.7, php-7.3.19, php-7.4.7RC1, php-7.3.19RC1, php-7.4.6, php-7.2.31, php-7.4.6RC1, php-7.3.18RC1 |
|
#
8fef83dd |
| 19-Apr-2020 |
George Peter Banyard |
Promote warnings to error in DOM extension Closes GH-5418
|