php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 16:22:37 +01:00
Code Issues Packages Projects Releases Wiki Activity
145,473 Commits 545 Branches 1,479 Tags
master
Commit Graph

291 Commits

Author SHA1 Message Date
Niels Dossche
f0f28b763c Merge branch 'PHP-8.5' 
* PHP-8.5:
  Fix GH-21097: Accessing Dom\Node properties can can throw TypeError(s)
 2026-02-03 18:41:13 +01:00
Niels Dossche
52eb174ba6 Merge branch 'PHP-8.4' into PHP-8.5 
* PHP-8.4:
  Fix GH-21097: Accessing Dom\Node properties can can throw TypeError(s)
 2026-02-03 18:40:54 +01:00
Niels Dossche
b8fc6bd1c8 Fix GH-21097: Accessing Dom\Node properties can can throw TypeError(s) 
Split the handler again, or defer to instanceof when performance doesn't
matter.

Closes GH-21108.
 2026-02-03 18:36:28 +01:00
Niels Dossche
0f4f73a254 Merge branch 'PHP-8.5' 
* PHP-8.5:
  Fix GH-21077: Accessing Dom\Node::baseURI can throw TypeError
 2026-01-30 18:14:24 +01:00
Niels Dossche
d54e5106b0 Merge branch 'PHP-8.4' into PHP-8.5 
* PHP-8.4:
  Fix GH-21077: Accessing Dom\Node::baseURI can throw TypeError
 2026-01-30 18:14:19 +01:00
Niels Dossche
d73b2f782e Fix GH-21077: Accessing Dom\Node::baseURI can throw TypeError 
Prior to this patch there was a common read handler, and it relied on
the dom class set in the intern document. However, Dom\Implementation
allows creating DTDs unassociated with a document, so we can't rely on
an intern document and the check fails. This causes the ZVAL_NULL() path
to be taken.
To solve this, just split the handler.

Closes GH-21082.
 2026-01-30 18:13:55 +01:00
Niels Dossche
004934ce60 Merge branch 'PHP-8.5' 
* PHP-8.5:
  Fix GH-20444: Dom\XMLDocument::C14N() seems broken compared to DOMDocument::C14N()
 2025-12-26 22:28:55 +01:00
Niels Dossche
31ae40d5e1 Merge branch 'PHP-8.4' into PHP-8.5 
* PHP-8.4:
  Fix GH-20444: Dom\XMLDocument::C14N() seems broken compared to DOMDocument::C14N()
 2025-12-26 22:28:51 +01:00
Niels Dossche
40c291cf93 Fix GH-20444: Dom\XMLDocument::C14N() seems broken compared to DOMDocument::C14N() 
C14N code expects namespace to be in-tree, but we store namespaces in a
different way out-of-tree to avoid reconciliations that break the tree
structure in a way unexpected by the DOM spec. In the DOM spec,
namespace nodes don't exist; they're regular attributes.
To solve this, we temporarily make fake namespace nodes that we later
remove.

Closes GH-20457.
 2025-12-26 22:27:25 +01:00
Niels Dossche
f5024930cc Merge branch 'PHP-8.5' 
* PHP-8.5:
  dom: Fix missing NUL byte check on C14NFile()
 2025-11-13 00:04:04 +01:00
Niels Dossche
abad39a42a Merge branch 'PHP-8.4' into PHP-8.5 
* PHP-8.4:
  dom: Fix missing NUL byte check on C14NFile()
 2025-11-13 00:03:56 +01:00
Niels Dossche
a103251eb2 Merge branch 'PHP-8.3' into PHP-8.4 
* PHP-8.3:
  dom: Fix missing NUL byte check on C14NFile()
 2025-11-13 00:03:36 +01:00
Niels Dossche
8ad5915756 dom: Fix missing NUL byte check on C14NFile() 
Closes GH-20466.
 2025-11-13 00:03:13 +01:00
Niels Dossche
618e576614 Minor DOM cleanups 2025-11-11 13:41:18 +01:00
Niels Dossche
f2aaea053c Use faster string construction in ext/dom in some places (#20005) 
Many tag names are single characters, so we can use the fast string
construction. In cases where a NULL name is used we can also use the
empty string.
This avoids some allocations and some work.
 2025-09-30 18:10:24 +02:00
Tim Düsterhus
f57e308e88 dom: Use true / false instead of 1 / 0 when assigning to bool 
Changes done with Coccinelle:

    @@
    bool b;
    @@

    - b = 0
    + b = false

    @@
    bool b;
    @@

    - b = 1
    + b = true
 2025-09-24 18:51:40 +02:00
Niels Dossche
8526de84a5 Move common obj_map API functions to obj_map.c 2025-06-22 12:30:50 +02:00
Niels Dossche
ff0a2cff05 Refactor implementation of DOM nodelists, named maps, and iterators 
The code was really messy with lots of checks and inconsistencies.
This splits everything up into different functions and now everything is
relayed to a handler vtable.
 2025-06-21 22:17:33 +02:00
Niels Dossche
1eacd4aea0 Avoid unnecessary string refcounting in ext/dom (#17889) 2025-02-23 00:23:22 +01:00
Niels Dossche
5471f117c5 Merge branch 'PHP-8.4' 
* PHP-8.4:
  Fix GH-17500: Segfault with requesting nodeName on nameless doctype
 2025-01-17 19:37:19 +01:00
Niels Dossche
525aeff070 Merge branch 'PHP-8.3' into PHP-8.4 
* PHP-8.3:
  Fix GH-17500: Segfault with requesting nodeName on nameless doctype
 2025-01-17 19:37:14 +01:00
Niels Dossche
82d71a82aa Fix GH-17500: Segfault with requesting nodeName on nameless doctype 
Closes GH-17344.
 2025-01-17 19:36:47 +01:00
Niels Dossche
7be3649016 Cleanup iterator instantiation code (#17358) 
Just using object_init_ex() directly makes the code a bit simpler and
avoids unnecessary indirections.
 2025-01-04 16:48:41 +01:00
Niels Dossche
59a0d00a5d Avoid string duplications in dom iterators 2025-01-03 17:50:01 +01:00
Niels Dossche
b112d27ff5 [ci skip] Update last check date for compareDocumentPosition() 
I validated there were no spec changes for this, so we can bump the last
check date.
 2024-11-17 13:41:59 +01:00
Niels Dossche
cfc8361fe6 Merge branch 'PHP-8.4' 
* PHP-8.4:
  Fix GH-16777: Calling the constructor again on a DOM object after it is in a document causes UAF
  Fix GH-16808: Segmentation fault in RecursiveIteratorIterator->current() with a xml element input
 2024-11-16 13:42:22 +01:00
Niels Dossche
d3fada3748 Merge branch 'PHP-8.3' into PHP-8.4 
* PHP-8.3:
  Fix GH-16777: Calling the constructor again on a DOM object after it is in a document causes UAF
  Fix GH-16808: Segmentation fault in RecursiveIteratorIterator->current() with a xml element input
 2024-11-16 13:42:14 +01:00
Niels Dossche
18b18f0ee0 Fix GH-16777: Calling the constructor again on a DOM object after it is in a document causes UAF 
Closes GH-16824.
 2024-11-16 13:42:01 +01:00
Niels Dossche
7f5a888bdb Change dom_node_is_read_only() to return bool (#16757) 
Returning int or zend_result doesn't make sense, it's a yes/no question.
 2024-11-11 20:57:52 +01:00
Niels Dossche
6e82ae9990 Merge branch 'PHP-8.3' into PHP-8.4 
* PHP-8.3:
  Fix GH-16595: Another UAF in DOM -> cloneNode
  Fix GH-16593: Assertion failure in DOM->replaceChild
 2024-10-28 19:45:22 +01:00
Niels Dossche
ed21ebd8aa Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix GH-16595: Another UAF in DOM -> cloneNode
  Fix GH-16593: Assertion failure in DOM->replaceChild
 2024-10-28 19:39:24 +01:00
Niels Dossche
9d8983c061 Fix GH-16595: Another UAF in DOM -> cloneNode 
We need to perform all sanity checks before doing any modification.
I don't have a reliable and easy test for this on 8.2, but I have one
for 8.4.

Closes GH-16598.
 2024-10-28 19:37:08 +01:00
Niels Dossche
d89dd28d3b Fix GH-16593: Assertion failure in DOM->replaceChild 
This is already forbidden by libxml, but this condition isn't properly
checked; so the return value and lack of error makes it seem like it
worked while it actually didn't. Furthermore, this can break assumptions
and assertions later on.

Closes GH-16596.
 2024-10-28 19:36:29 +01:00
Niels Dossche
a0266920e4 Merge branch 'PHP-8.3' into PHP-8.4 
* PHP-8.3:
  Fix GH-16535: UAF when using document as a child
  Fix GH-16533: Segfault when adding attribute to parent that is not an element
 2024-10-21 20:57:42 +02:00
Niels Dossche
5a09e0105e Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix GH-16535: UAF when using document as a child
  Fix GH-16533: Segfault when adding attribute to parent that is not an element
 2024-10-21 20:57:22 +02:00
Niels Dossche
51b642f2c9 Fix GH-16535: UAF when using document as a child 
Documents can never be children of any node.

Closes GH-16539.
 2024-10-21 20:56:14 +02:00
Niels Dossche
a0a7361b64 Fix GH-16533: Segfault when adding attribute to parent that is not an element 
Attributes are only valid as children of elements. This bug goes back
all the way.

Closes GH-16537.
 2024-10-21 20:55:42 +02:00
Niels Dossche
81a2cd4dac Merge branch 'PHP-8.3' into PHP-8.4 
* PHP-8.3:
  Fix various document ref pointer mismanagements
 2024-10-17 21:21:49 +02:00
Niels Dossche
5cb38e9d24 Fix various document ref pointer mismanagements 
- Properly handle attributes
- Fix potential NULL dereference if the intern document pointer is NULL

Fixes GH-16336.
Fixes GH-16338.
Closes GH-16345.
 2024-10-17 21:18:50 +02:00
Niels Dossche
b7b0b954be Restore accidentally deleted check 2024-10-12 13:41:24 +02:00
Niels Dossche
c31eac7284 Merge branch 'PHP-8.3' into PHP-8.4 
* PHP-8.3:
  Add missing hierarchy checks to replaceChild
  Fix GH-16337: Use-after-free in SplHeap
 2024-10-12 13:39:06 +02:00
Niels Dossche
3ed01d454d Add missing hierarchy checks to replaceChild 
You can break the hierarchy for attribute nodes, use the helper function
introduced recently [1] to fix this issue.

[1] 066d18f2

Closes GH-16377.
 2024-10-12 13:32:13 +02:00
Niels Dossche
ba0834bc2c Merge branch 'PHP-8.3' into PHP-8.4 
* PHP-8.3:
  Fix bugs GH-16150 and GH-16152: intern document mismanagement
 2024-10-03 19:33:09 +02:00
Niels Dossche
d4a4d2e7a9 Fix bugs GH-16150 and GH-16152: intern document mismanagement 
The reference counts of the internal document pointer are mismanaged.
In the case of fragments the refcount may be increased too much, while
for other cases the document reference may not be applied to all
children.

This bug existed for a long time and this doesn't reproduce (easily)
on 8.2 due to other bugs. Furthermore 8.2 will enter security mode soon,
and this change may be too risky.

Fixes GH-16150.
Fixed GH-16152.
Closes GH-16178.
 2024-10-03 19:28:50 +02:00
Niels Dossche
3be6ff66b8 Fix GH-16190: Using reflection to call Dom\Node::__construct causes assertion failure 
Closes GH-16193.
 2024-10-03 19:25:58 +02:00
Niels Dossche
341c26fc3f Merge branch 'PHP-8.3' into PHP-8.4 
* PHP-8.3:
  Fix GH-16151: Assertion failure in ext/dom/parentnode/tree.c
 2024-10-01 21:47:52 +02:00
Niels Dossche
cd67c090a9 Merge branch 'PHP-8.2' into PHP-8.3 
* PHP-8.2:
  Fix GH-16151: Assertion failure in ext/dom/parentnode/tree.c
 2024-10-01 21:47:26 +02:00
Niels Dossche
066d18f2e8 Fix GH-16151: Assertion failure in ext/dom/parentnode/tree.c 
Unfortunately, old DOM allows attributes to be used as parent nodes.
Only text nodes and entities are allowed as children for these types of
nodes, because that's the constraint DOM and libxml give us.

Closes GH-16156.
 2024-10-01 21:46:12 +02:00
Niels Dossche
067eb8c0d7 [ci skip] Remove confusing comments 
They are readonly / not readonly depending on the class where they're used.
However, the comment makes this confusing [1].

[1] https://github.com/php/php-src/issues/15578#issuecomment-2310389300
 2024-08-27 22:24:39 +02:00
Niels Dossche
2cfcfe09a0 Convert more common methods in dom/node.c to fast ZPP (#15043) 2024-07-20 20:20:32 +02:00