DOMAttr unescapes character reference

[t-tera]

Description

The following code:

<?php
$node = new DOMAttr('foo','bar');
$node->nodeValue = 'xx&#x31;yy';
var_dump($node->nodeValue);

Resulted in this output:

xx1yy

But I expected this output instead:

xx1yy

As shown above, setter of nodeValue unescapes character references.
Because of this, I need to do the following:

$node->nodeValue = htmlspecialchars("xx1yy");
var_dump($node->nodeValue);

This outputs xx1yy. The setter should not unescape character references.

PHP Version

PHP 7.4.3

Operating System

Ubuntu 20.04

[iluuu1994]

I'm on the phone so I can't verify, but I don't think this has anything to do with DOMAttr but rather just the fact that var_dump doesn't escape its output and thus the browser converts it.

Edit: Also note that PHP 7.4 is unsupported.

[t-tera]

No. I'm testing it on CLI.

# php -r '$node = new DOMAttr("foo","bar"); $node->nodeValue = "xx1yy"; var_dump($node->nodeValue);'
string(5) "xx1yy"

[damianwadley]

Bug confirmed https://3v4l.org/Xf27Y , given that Attrs in a browser don't work the same way and that I can't see either the HTML 4 or Living Standard specifying any transformations should happen, but this is likely an issue with libxml and not PHP.

[cmb69]

Writing the nodeValue is implemented by calling xmlNodeSetContentLen(), and its documentation states:

Replace the content of a node. NOTE: @content is supposed to be a piece of XML CDATA, so it allows entity references, but XML special chars need to be escaped first by using xmlEncodeEntitiesReentrant() resp. xmlEncodeSpecialChars().

Our implementation does not escape, though.

Reading the nodeValue is implemented by calling xmlNodeGetContent(), and its documentation states:

Entity references are substituted.

Changing this would cause a pretty serious BC break.

[cmb69]

I think this qualifies as bug, but due to the BC break when we fix it, I'm reluctant to do this.

@beberlei, thoughts?

[nielsdos]

Fixed via GH-10132.

[tstarling]

Do you think it needs a changelog table entry in the manual?

[nielsdos]

Yes. This should happen for us by the docs maintainers because there's an UPGRADING entry. But I opened PR php/doc-en#2520 already so it will certainly not be forgotten.