Re: XSLTProcessor max depth

On Sat, Sep 30, 2023, at 10:18 AM, Niels Dossche wrote: > Hi internals > > I'm looking to address > https://bugs.php.net/bug.php?id=71571. > TL;DR: XSL has a maximum recursion depth, and it may even depend on the > distro/OS config. > For complex inputs you may reach this limit, but PHP offers no way to > change that limit. > > As we already have methods in XSLTProcessor to configure certain things > (e.g. setProfiling, setSecurityPrefs), it may be an idea to add > setMaxDepth(int $depth) or something alike. > > Unfortunately, XSLTProcessor is non-final, so if a user class extends > this class and coincidentally already has a method with the same name > but incompatible signature, then they would get a compile error. > > What do you think? > > Kind regards > Niels In context, I cannot imagine why someone would have a setMaxDepth() method with that name, since, AIUI, they wouldn't be able to actually set the max depth. So I think the chances of there being a conflict are extremely remote, and an acceptable risk. This could be verified by doing a "top packages" scan using Nikita's script, which is probably a good step anyway. --Larry Garfield