note 76063 added to function.xslt-process

It is possible that the xslt_process call can expose information about Apache's installation location if null values are passed to the signature. for example: <?php $xslt = xslt_create(); $result = xslt_process($xslt, null, null); echo $result; ?> The error you will recieve is: Warning: Sablotron error on line none: cannot open file 'C:\Program Files\Apache Group\Apache2/' in C:\webroot\htdocs\projects\www\sales\test.php on line 4 Although trying to read a 'null' XML file and 'null' XSL stylesheet are rather silly, consider an attacker tries to upload an arbitrary file and execute it with similar code. the user may then gain enough information to attack your site. ---- Server IP: 64.71.164.2 Probable Submitter: 209.150.201.146 ---- Manual Page -- http://www.php.net/manual/en/function.xslt-process.php Edit -- https://master.php.net/note/edit/76063 Del: integrated -- https://master.php.net/note/delete/76063/integrated Del: useless -- https://master.php.net/note/delete/76063/useless Del: bad code -- https://master.php.net/note/delete/76063/bad+code Del: spam -- https://master.php.net/note/delete/76063/spam Del: non-english -- https://master.php.net/note/delete/76063/non-english Del: in docs -- https://master.php.net/note/delete/76063/in+docs Del: other reasons-- https://master.php.net/note/delete/76063 Reject -- https://master.php.net/note/reject/76063 Search -- https://master.php.net/manage/user-notes.php