--TEST-- registerPHPFunctionNS() function - legit cases --EXTENSIONS-- xsl --SKIPIF-- --FILE-- state[] = [$name, $arguments[0]]; return $arguments[0]; } } function createProcessor($inputs) { $xsl = new DomDocument(); $xsl->loadXML(' ' . implode('', array_map(fn($input) => '', $inputs)) . ' '); $proc = new XSLTProcessor(); $proc->importStylesheet($xsl); return $proc; } $inputdom = new DomDocument(); $inputdom->loadXML('hello'); echo "--- Legit cases: none ---\n"; $proc = createProcessor(["foo:var_dump(string(@href))"]); try { // Note: since libxml2 commit aca16fb3d45e0b2c45364ffc1cea8eb4abaca87d this only outputs 1 warning. This seems intentional. // Easiest workaround is silencing the warnings @$proc->transformToXml($inputdom); } catch (Error $e) { echo $e->getMessage(), "\n"; } echo "--- Legit cases: global function callable ---\n"; $proc = createProcessor(["foo:var_dump(string(@href))"]); $proc->registerPHPFunctionNS('urn:foo', 'var_dump', var_dump(...)); $proc->transformToXml($inputdom); echo "--- Legit cases: global string callable ---\n"; $proc = createProcessor(["foo:var_dump(string(@href))"]); $proc->registerPHPFunctionNS('urn:foo', 'var_dump', 'var_dump'); $proc->transformToXml($inputdom); echo "--- Legit cases: trampoline callable ---\n"; $proc = createProcessor(["foo:trampoline(string(@href))"]); $proc->registerPHPFunctionNS('urn:foo', 'trampoline', TrampolineClass::test(...)); var_dump($proc->transformToXml($inputdom)); echo "--- Legit cases: instance class method callable ---\n"; $state = new StatefulClass; $proc = createProcessor(["foo:test(string(@href))"]); $proc->registerPHPFunctionNS('urn:foo', 'test', $state->test(...)); var_dump($proc->transformToXml($inputdom)); var_dump($state->state); echo "--- Legit cases: multiple namespaces ---\n"; $proc = createProcessor(["foo:test(string(@href))", "bar:test(string(@href))"]); $proc->registerPHPFunctionNS('urn:foo', 'test', strrev(...)); $proc->registerPHPFunctionNS('urn:bar', 'test', strtoupper(...)); var_dump($proc->transformToXml($inputdom)); ?> --EXPECTF-- --- Legit cases: none --- --- Legit cases: global function callable --- string(15) "https://php.net" --- Legit cases: global string callable --- string(15) "https://php.net" --- Legit cases: trampoline callable --- string(4) "test" array(1) { [0]=> string(15) "https://php.net" } string(26) " foo " --- Legit cases: instance class method callable --- string(38) " https://php.net " array(1) { [0]=> array(2) { [0]=> string(4) "test" [1]=> string(15) "https://php.net" } } --- Legit cases: multiple namespaces --- string(53) " ten.php//:sptthHTTPS://PHP.NET "