Bug #80559 [ReO]: xmlrpc has no PECL releases to download

Edit report at https://bugs.php.net/bug.php?id=80559&edit=1 ID: 80559 Updated by: cmb@php.net Reported by: giunta dot gaetano at gmail dot com Summary: xmlrpc has no PECL releases to download Status: Re-Opened Type: Bug Package: XMLRPC-EPI related Operating System: ubuntu PHP Version: 7.4.13 Assigned To: cmb Block user comment: N Private report: N New Comment: From the respective RFC[1]: | We are not doing users a favor by having an extension which relies | on an unmaintained library, which may have serious issues and | maybe even vulnerabilites, without signalling that issue. Since | the problem with xmlrpc does not appear to be its functionality or | API, but rather the lack of maintainance, a deprecation does not | seem appropriate. Moving the extension to PECL is supposed to give | users that signal, so they can reevaluate their use of the | extension. That said, I'll do a release ASAP, but I strongly suggest that everybody who is still using this extension, to look out for an alternative, perhaps <https://github.com/gggeek/polyfill-xmlrpc>. [1] <https://wiki.php.net/rfc/unbundle_xmlprc> Previous Comments: ------------------------------------------------------------------------ [2020-12-29 19:21:55] requinix@php.net > I know that the xmlrpc extension has been removed from php 8 and is thus > probably in a strict 'maintenance only' mode, but would it make sense to try to > make it easier for end users to install the non-buggy version from PECL? @cmb? ------------------------------------------------------------------------ [2020-12-29 10:16:50] giunta dot gaetano at gmail dot com Indeed I experienced this bug on Ubuntu's native php version, which uses a shared library for libxmlrpc-epi. The problem has been reported upstream to Debian, and has been lingering in their bug tracker for a while :-( see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=883747 Also, I managed to dig out the original bug report which led to this issue being fixed within php's source code: https://bugs.php.net/bug.php?id=28597 I know that the xmlrpc extension has been removed from php 8 and is thus probably in a strict 'maintenance only' mode, but would it make sense to try to make it easier for end users to install the non-buggy version from PECL? ------------------------------------------------------------------------ [2020-12-28 22:25:33] requinix@php.net *does not work (note the if c >= 10) ------------------------------------------------------------------------ [2020-12-28 22:25:03] requinix@php.net Upstream bug. Bundled libxmlrpc-epi is good http://git.php.net/?p=pecl/networking/xmlrpc.git;a=blob;f=libxmlrpc/xml_element.c;h=16787593516d492fcf720b0d3eea22934bae02f0;hb=refs/heads/master#l279 but this version on SourceForge does https://sourceforge.net/p/xmlrpc-epi/git/ci/master/tree/src/xml_element.c#l290 ------------------------------------------------------------------------ [2020-12-28 20:17:43] giunta dot gaetano at gmail dot com Description: ------------ Function xmlrpc_encode and xmlrpc_encode_request do encode all characters above 127 to their numeric entity representation, eg: chr(129) => '&#129;' However there seems to be a bug for characters between 200 and 209 - for those the numeric entities generated are '&#20;' to '&#29;'. The code in the source library, file 'xml_element.c' seems to have a bug in function create_xml_escape. The same bug would apply for characters 100 to 109, however that does not happen because those characters are not encoded as entities in the first place. Test script: --------------- echo xmlrpc_encode(chr(199).chr(200).chr(209).chr(210); Expected result: ---------------- <?xml version="1.0" encoding="utf-8"?><params><param><value><string>&#199;&#200;&#209;&#210;</string></value></param></params> Actual result: -------------- <?xml version="1.0" encoding="utf-8"?><params><param><value><string>&#199;&#20;&#29;&#210;</string></value></param></params> ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=80559&edit=1