Edit report at https://bugs.php.net/bug.php?id=67350&edit=1
ID: 67350
Comment by: ant-dani-2 at hotmail dot com
Reported by: rjlaustin at teksavvy dot com
Summary: An XML DTD with an external parameter failes to
include the subset
Status: Open
Type: Bug
Package: DOM XML related
Operating System: Linux
PHP Version: 5.4.28
Block user comment: N
Private report: N
New Comment:
So I found out this is not really a bug, but the result of a security patch agains XXE Injection.
If you're just loading a local trusted xml file, don't forget to explicitly tell libxml2
to load the external entities:
$xml = new DOMDocument();
$xml->load("your.xml", LIBXML_DTDLOAD | LIBXML_DTDATTR | LIBXML_DTDVALID);
This will "fix" your bug. I hope it helps you.
Previous Comments:
------------------------------------------------------------------------
[2014-06-01 22:59:10] ant-dani-2 at hotmail dot com
+1
Same thing happens on my ubuntu 14.04 server with PHP Version 5.5.9-1ubuntu4 (built Apr 9 2014).
Exactly same situation when including an external DTD.
On my development WAMP server with PHP Version 5.5.12 (built Apr 30 2014), this bug does not occur.
Not sure if the bug was fixed as of PHP Version 5.5.10
------------------------------------------------------------------------
[2014-05-28 02:10:25] rjlaustin at teksavvy dot com
Description:
------------
This problem occurs on two Linux systems where my code is used but over which I have no control and
limited information. One is on version 5.4.28, built May 5 2014, the other is on 5.5.3-1, built
April 4 2014. The problem did not occur on whatever versions they were running before last week.
The validation of XML against a DTD fails, complaining that one or more entities has no declaration.
The message is:
DOMDocument::validate(): No declaration for element xxxx
All the elements complained of are in subsets that are (or rather were, because I have had to change
them all) included in the outer DTD by means of the external parameter notation, e.g.
<!ENTITY % theatre SYSTEM "theatre.dtd">
later followed by
%theatre;
It appears that the contents of (in this case) "theatre.dtd" are simply lost.
Putting the contents of the file inline in the outer DTD is a successful workaround.
I have tested the latest Mac version of PHP available from XAMPP (5.5.11 built April 9) and it does
NOT have this bug.
Since I have to support my code on any system, even if this problem gets fixed I will never be able
to use this feature again because I will never know when a all the potential users have moved up to
the fixed release. It's an annoying loss of a convenient feature but it isn't a
show-stopper.
Test script:
---------------
I'm afraid I am not in a position to ask the people who got the problem to restore their code
so as to demonstrate it now. And I haven't got a system of my own that displays the problem. A
fix will be of no use to me now, but if there is interest in getting it fixed and you need more
documentation I could probably work up a little demonstration script.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=67350&edit=1