[php-src] PR #23069: Reject embedded NUL in SimpleXMLElement path/URL constructor
| From: | iliaal | Date: | Wed, 05 Aug 2026 13:27:40 +0000 |
| Subject: | [php-src] PR #23069: Reject embedded NUL in SimpleXMLElement path/URL constructor | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37557@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23069
Author: iliaal
With dataIsURL set, SimpleXMLElement::__construct hands its first argument to xmlReadFile as a C
string, so
new SimpleXMLElement("/tmp/ok.xml\0anything", 0, true) quietly
loads /tmp/ok.xml. simplexml_load_file already rejects this because its filename parameter is
declared as a path; the constructor takes a plain string and never runs the check. The constructor
now throws the same ValueError before reaching xmlReadFile.