Skip to content

Commit 243fa9c

Browse files
nielsdosramsey
nielsdos
authored and
ramsey
committedNov 23, 2023
Fix phpGH-12616: DOM: Removing XMLNS namespace node results in invalid default: prefix
The namespace data is freed and set to NULL, but there remain references to the namespace declaration nodes. This (rightfully) confuses libxml2 because its invariants are broken. We also have to remove all remaining references from the subtree. This fixes the data corruption bug. Closes phpGH-12681.
1 parent 6a76e5d commit 243fa9c

File tree

5 files changed

+309
-8
lines changed

5 files changed

+309
-8
lines changed
 

‎NEWS

+4
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ PHP NEWS
22
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
33
?? ??? ????, PHP 8.1.27
44

5+
- DOM:
6+
. Fixed bug GH-12616 (DOM: Removing XMLNS namespace node results in invalid
7+
default: prefix). (nielsdos)
8+
59
- Intl:
610
. Fixed bug GH-12635 (Test bug69398.phpt fails with ICU 74.1). (nielsdos)
711

‎ext/dom/element.c

+78-8
Original file line numberDiff line numberDiff line change
@@ -724,6 +724,83 @@ PHP_METHOD(DOMElement, setAttributeNS)
724724
}
725725
/* }}} end dom_element_set_attribute_ns */
726726

727+
static void dom_remove_eliminated_ns_single_element(xmlNodePtr node, xmlNsPtr eliminatedNs)
728+
{
729+
ZEND_ASSERT(node->type == XML_ELEMENT_NODE);
730+
if (node->ns == eliminatedNs) {
731+
node->ns = NULL;
732+
}
733+
734+
for (xmlAttrPtr attr = node->properties; attr != NULL; attr = attr->next) {
735+
if (attr->ns == eliminatedNs) {
736+
attr->ns = NULL;
737+
}
738+
}
739+
}
740+
741+
static void dom_remove_eliminated_ns(xmlNodePtr node, xmlNsPtr eliminatedNs)
742+
{
743+
dom_remove_eliminated_ns_single_element(node, eliminatedNs);
744+
745+
xmlNodePtr base = node;
746+
node = node->children;
747+
while (node != NULL) {
748+
ZEND_ASSERT(node != base);
749+
750+
if (node->type == XML_ELEMENT_NODE) {
751+
dom_remove_eliminated_ns_single_element(node, eliminatedNs);
752+
753+
if (node->children) {
754+
node = node->children;
755+
continue;
756+
}
757+
}
758+
759+
if (node->next) {
760+
node = node->next;
761+
} else {
762+
/* Go upwards, until we find a parent node with a next sibling, or until we hit the base. */
763+
do {
764+
node = node->parent;
765+
if (node == base) {
766+
return;
767+
}
768+
} while (node->next == NULL);
769+
node = node->next;
770+
}
771+
}
772+
}
773+
774+
static void dom_eliminate_ns(xmlNodePtr nodep, xmlNsPtr nsptr)
775+
{
776+
if (nsptr->href != NULL) {
777+
xmlFree((char *) nsptr->href);
778+
nsptr->href = NULL;
779+
}
780+
if (nsptr->prefix != NULL) {
781+
xmlFree((char *) nsptr->prefix);
782+
nsptr->prefix = NULL;
783+
}
784+
785+
/* Remove it from the list and move it to the old ns list */
786+
xmlNsPtr current_ns = nodep->nsDef;
787+
if (current_ns == nsptr) {
788+
nodep->nsDef = nsptr->next;
789+
} else {
790+
do {
791+
if (current_ns->next == nsptr) {
792+
current_ns->next = nsptr->next;
793+
break;
794+
}
795+
current_ns = current_ns->next;
796+
} while (current_ns != NULL);
797+
}
798+
nsptr->next = NULL;
799+
dom_set_old_ns(nodep->doc, nsptr);
800+
801+
dom_remove_eliminated_ns(nodep, nsptr);
802+
}
803+
727804
/* {{{ URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-ElRemAtNS
728805
Since: DOM Level 2
729806
*/
@@ -754,14 +831,7 @@ PHP_METHOD(DOMElement, removeAttributeNS)
754831
nsptr = dom_get_nsdecl(nodep, (xmlChar *)name);
755832
if (nsptr != NULL) {
756833
if (xmlStrEqual((xmlChar *)uri, nsptr->href)) {
757-
if (nsptr->href != NULL) {
758-
xmlFree((char *) nsptr->href);
759-
nsptr->href = NULL;
760-
}
761-
if (nsptr->prefix != NULL) {
762-
xmlFree((char *) nsptr->prefix);
763-
nsptr->prefix = NULL;
764-
}
834+
dom_eliminate_ns(nodep, nsptr);
765835
} else {
766836
RETURN_NULL();
767837
}

‎ext/dom/tests/gh12616_1.phpt

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
--TEST--
2+
GH-12616 (DOM: Removing XMLNS namespace node results in invalid default: prefix)
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
8+
$doc = new DOMDocument();
9+
$doc->loadXML(
10+
<<<XML
11+
<container xmlns="http://symfony.com/schema/dic/services">
12+
CHILDREN
13+
</container>
14+
XML
15+
);
16+
17+
$doc->documentElement->removeAttributeNS('http://symfony.com/schema/dic/services', '');
18+
echo $doc->saveXML();
19+
20+
$new = new DOMDocument();
21+
$new->append(
22+
$new->importNode($doc->documentElement, true)
23+
);
24+
25+
echo $new->saveXML();
26+
27+
?>
28+
--EXPECT--
29+
<?xml version="1.0"?>
30+
<container>
31+
CHILDREN
32+
</container>
33+
<?xml version="1.0"?>
34+
<container>
35+
CHILDREN
36+
</container>

‎ext/dom/tests/gh12616_2.phpt

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
--TEST--
2+
GH-12616 (DOM: Removing XMLNS namespace node results in invalid default: prefix)
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
8+
$doc = new DOMDocument();
9+
$doc->loadXML(
10+
<<<XML
11+
<container xmlns:test="urn:test" xmlns:symfony="http://symfony.com/schema/dic/services">
12+
<symfony:services>
13+
<test:service id="hello" />
14+
</symfony:services>
15+
</container>
16+
XML
17+
);
18+
19+
$doc->documentElement->removeAttributeNS('http://symfony.com/schema/dic/services', 'symfony');
20+
$xpath = new DOMXPath($doc);
21+
$xpath->registerNamespace('test', 'urn:test');
22+
23+
echo $doc->saveXML();
24+
25+
$result = $xpath->query('//container/services/test:service[@id="hello"]');
26+
var_dump($result);
27+
28+
?>
29+
--EXPECT--
30+
<?xml version="1.0"?>
31+
<container xmlns:test="urn:test">
32+
<services>
33+
<test:service id="hello"/>
34+
</services>
35+
</container>
36+
object(DOMNodeList)#4 (1) {
37+
["length"]=>
38+
int(1)
39+
}

‎ext/dom/tests/gh12616_3.phpt

+152
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
--TEST--
2+
GH-12616 (DOM: Removing XMLNS namespace node results in invalid default: prefix)
3+
--EXTENSIONS--
4+
dom
5+
--FILE--
6+
<?php
7+
8+
$doc = new DOMDocument();
9+
$doc->loadXML(
10+
<<<XML
11+
<container>
12+
<child1 xmlns:x="http://symfony.com/schema/dic/services">
13+
<x:foo x:bar=""/>
14+
<x:foo x:bar=""/>
15+
</child1>
16+
<child2 xmlns:x="http://symfony.com/schema/dic/services">
17+
<x:foo x:bar=""/>
18+
<x:foo x:bar=""/>
19+
</child2>
20+
</container>
21+
XML
22+
);
23+
24+
$doc->documentElement->firstElementChild->removeAttributeNS('http://symfony.com/schema/dic/services', 'x');
25+
echo $doc->saveXML();
26+
27+
$xpath = new DOMXPath($doc);
28+
29+
echo "--- Namespaces of child1 ---\n";
30+
31+
foreach ($xpath->query("/container/child1/namespace::*") as $ns) {
32+
var_dump($ns);
33+
}
34+
35+
echo "--- Namespaces of child1/foo (both nodes) ---\n";
36+
37+
foreach ($xpath->query("/container/child1/foo/namespace::*") as $ns) {
38+
var_dump($ns);
39+
}
40+
41+
echo "--- Namespaces of child2 ---\n";
42+
43+
foreach ($xpath->query("/container/child2/namespace::*") as $ns) {
44+
var_dump($ns);
45+
}
46+
47+
?>
48+
--EXPECT--
49+
<?xml version="1.0"?>
50+
<container>
51+
<child1>
52+
<foo bar=""/>
53+
<foo bar=""/>
54+
</child1>
55+
<child2 xmlns:x="http://symfony.com/schema/dic/services">
56+
<x:foo x:bar=""/>
57+
<x:foo x:bar=""/>
58+
</child2>
59+
</container>
60+
--- Namespaces of child1 ---
61+
object(DOMNameSpaceNode)#4 (8) {
62+
["nodeName"]=>
63+
string(9) "xmlns:xml"
64+
["nodeValue"]=>
65+
string(36) "http://www.w3.org/XML/1998/namespace"
66+
["nodeType"]=>
67+
int(18)
68+
["prefix"]=>
69+
string(3) "xml"
70+
["localName"]=>
71+
string(3) "xml"
72+
["namespaceURI"]=>
73+
string(36) "http://www.w3.org/XML/1998/namespace"
74+
["ownerDocument"]=>
75+
string(22) "(object value omitted)"
76+
["parentNode"]=>
77+
string(22) "(object value omitted)"
78+
}
79+
--- Namespaces of child1/foo (both nodes) ---
80+
object(DOMNameSpaceNode)#5 (8) {
81+
["nodeName"]=>
82+
string(9) "xmlns:xml"
83+
["nodeValue"]=>
84+
string(36) "http://www.w3.org/XML/1998/namespace"
85+
["nodeType"]=>
86+
int(18)
87+
["prefix"]=>
88+
string(3) "xml"
89+
["localName"]=>
90+
string(3) "xml"
91+
["namespaceURI"]=>
92+
string(36) "http://www.w3.org/XML/1998/namespace"
93+
["ownerDocument"]=>
94+
string(22) "(object value omitted)"
95+
["parentNode"]=>
96+
string(22) "(object value omitted)"
97+
}
98+
object(DOMNameSpaceNode)#8 (8) {
99+
["nodeName"]=>
100+
string(9) "xmlns:xml"
101+
["nodeValue"]=>
102+
string(36) "http://www.w3.org/XML/1998/namespace"
103+
["nodeType"]=>
104+
int(18)
105+
["prefix"]=>
106+
string(3) "xml"
107+
["localName"]=>
108+
string(3) "xml"
109+
["namespaceURI"]=>
110+
string(36) "http://www.w3.org/XML/1998/namespace"
111+
["ownerDocument"]=>
112+
string(22) "(object value omitted)"
113+
["parentNode"]=>
114+
string(22) "(object value omitted)"
115+
}
116+
--- Namespaces of child2 ---
117+
object(DOMNameSpaceNode)#9 (8) {
118+
["nodeName"]=>
119+
string(9) "xmlns:xml"
120+
["nodeValue"]=>
121+
string(36) "http://www.w3.org/XML/1998/namespace"
122+
["nodeType"]=>
123+
int(18)
124+
["prefix"]=>
125+
string(3) "xml"
126+
["localName"]=>
127+
string(3) "xml"
128+
["namespaceURI"]=>
129+
string(36) "http://www.w3.org/XML/1998/namespace"
130+
["ownerDocument"]=>
131+
string(22) "(object value omitted)"
132+
["parentNode"]=>
133+
string(22) "(object value omitted)"
134+
}
135+
object(DOMNameSpaceNode)#5 (8) {
136+
["nodeName"]=>
137+
string(7) "xmlns:x"
138+
["nodeValue"]=>
139+
string(38) "http://symfony.com/schema/dic/services"
140+
["nodeType"]=>
141+
int(18)
142+
["prefix"]=>
143+
string(1) "x"
144+
["localName"]=>
145+
string(1) "x"
146+
["namespaceURI"]=>
147+
string(38) "http://symfony.com/schema/dic/services"
148+
["ownerDocument"]=>
149+
string(22) "(object value omitted)"
150+
["parentNode"]=>
151+
string(22) "(object value omitted)"
152+
}

0 commit comments

Comments
 (0)
Please sign in to comment.