[php-src] Issue #8388: DOMAttr unescapes character reference
| From: | cmb69 | Date: | Sun, 17 Apr 2022 14:28:09 +0000 |
| Subject: | [php-src] Issue #8388: DOMAttr unescapes character reference | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-241045@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8388
Comment Author: cmb69
Writing the
nodeValue is implemented by calling xmlNodeSetContentLen(),
and [its
documentation](https://gnome.pages.gitlab.gnome.org/libxml2/devhelp/libxml2-tree.html#xmlNodeSetContentLen)
states:
> Replace the content of a node. NOTE: @content is supposed to be
> a piece of XML CDATA, so it allows entity references, but XML special chars need to be escaped first
> by using xmlEncodeEntitiesReentrant() resp. xmlEncodeSpecialChars().
Our implementation does not escape, though.
Reading the nodeValue is implemented by calling xmlNodeGetContent(), and
[its
documentation](https://gnome.pages.gitlab.gnome.org/libxml2/devhelp/libxml2-tree.html#xmlNodeGetContent)
states:
> Entity references are substituted.
Changing this would cause a pretty serious BC break.