Bug #15602 [Com]: attributes don't get escaped sometimes

Edit report at http://pear.php.net/bugs/bug.php?id=15602&edit=1 ID: 15602 Comment by: ao2 Reported By: ao2 at ao2 dot it Summary: attributes don't get escaped sometimes Status: Closed Type: Bug Package: XML_Serializer Package Version: 0.19.1 PHP Version: 5.2.8 Assigned To: ashnazg New Comment: Hi, with XML_Serializer-0.20.2 I get double encoded entities in some attributes when running: phpunit tests/bug-15602.phpt The bug tracker mangles the output here, decoding the entities... but the output is somethat like this. $ phpunit tests/bug-15602.phpt PHPUnit 5.2.10 by Sebastian Bergmann and contributors. F 1 / 1 (100%) Time: 118 ms, Memory: 2.00Mb There was 1 failure: 1) tests/bug-15602.phpt Failed asserting that two strings are equal. --- Expected +++ Actual @@ @@ '<?xml version="1.0" encoding="UTF-8"?> -<FooTag attr1="I say: "A", B & C, &apos;d&apos;!"> - <tag1 attr1="I say: "A", B & C, &apos;d&apos;!"> +<FooTag attr1="I say: "A", B & C, &apos;d&apos;!"> + <tag1 attr1="I say: "A", B & C, &apos;d&apos;!"> <tag2>I say: "A", B & C, &apos;d&apos;!</tag2> </tag1> <tag3 attr1="I say: "A", B & C, &apos;d&apos;!">I say: "A", B & C, &apos;d&apos;!</tag3> </FooTag>' FAILURES! Tests: 1, Assertions: 1, Failures: 1. The issue goes away if I remove the code at line 1215 in XML_Serializer.php, in function _createXMLTag(), but I ma not sure if this is the correct fix. diff --git a/XML_Serializer-0.20.2/XML/Serializer.php b/XML_Serializer-0.20.2/XML/Serializer.php index a757d4b..06eea51 100644 --- a/XML_Serializer-0.20.2/XML/Serializer.php +++ b/XML_Serializer-0.20.2/XML/Serializer.php @@ -598,7 +598,7 @@ class XML_Serializer extends PEAR * * @access public */ - function XML_Serializer( $options = null ) + function __construct( $options = null ) { $this->PEAR(); if (is_array($options)) { @@ -1209,15 +1209,6 @@ $tag['content'] = '0'; // this is a nested call, so value is already encoded // and must not be encoded again $replaceEntities = XML_SERIALIZER_ENTITIES_NONE; - // but attributes need to be encoded anyways - // (done here because the rest of the code assumes the same encoding - // can be used both for attributes and content) - foreach ($tag['attributes'] as $k => $v) { - $v = XML_Util::replaceEntities($v, - $this->options[XML_SERIALIZER_OPTION_ENTITIES]); - - $tag['attributes'][$k] = $v; - } } if (is_scalar($tag['content']) || is_null($tag['content'])) { if ($this->options[XML_SERIALIZER_OPTION_ENCODE_FUNC]) { Can anyone confirm the issue and the fix? Thanks, Antonio Previous Comments: ------------------------------------------------------------------------ [2009-04-24 17:53:19] kovaltaras This fix not working in PHP 4.x. Check errors ------------------------------------------------------------------------ [2009-01-24 23:09:02] ashnazg The provided test case performs as described, with me testing XML_Serializer-0.19.1 on PHP 5.2.6 on Ubuntu-8.10. The attached patch (with missing brackets added) makes the test work, without breaking any existing tests. Change committed to CVS, and test case added. ------------------------------------------------------------------------ [2009-01-15 09:35:52] doconnor Copied test script <?php require_once('XML/Serializer.php'); define('XML_ATTR', 'XML_Attributes_Array'); $options = array( XML_SERIALIZER_OPTION_INDENT => ' ', XML_SERIALIZER_OPTION_LINEBREAKS => "\n", XML_SERIALIZER_OPTION_ROOT_NAME => 'FooTag', XML_SERIALIZER_OPTION_MODE => XML_SERIALIZER_MODE_SIMPLEXML, XML_SERIALIZER_OPTION_ATTRIBUTES_KEY => XML_ATTR, XML_SERIALIZER_OPTION_XML_ENCODING => 'UTF-8', XML_SERIALIZER_OPTION_XML_DECL_ENABLED => true, XML_SERIALIZER_OPTION_ENTITIES => XML_SERIALIZER_ENTITIES_XML, ); $v = 'I say: "A", B & C, \'d\'!'; $a = array('attr1' => $v); $xml = array( XML_ATTR => $a, 'tag1' => array(XML_ATTR => $a, 'tag2' => $v), 'tag3' => array(XML_ATTR => $a, $v), ); $serializer = new XML_Serializer($options); $serializer->serialize($xml); echo $serializer->getSerializedData(); ------------------------------------------------------------------------ [2009-01-13 17:39:36] jesse I just ran across this today and patched the version we are using. All I did was change line 832 in Serializer.php to: $atts[$this->options[XML_SERIALIZER_OPTION_ATTRIBUTE_KEY]] = XML_Util::replaceEntities($origKey, $this->options[XML_SERIALIZER_OPTION_ENTITIES]); There's a chance that's not the complete, proper solution, but it does the trick for me. Probably needs to be done in the Unserializer.php, too, but I didn't care about that. ------------------------------------------------------------------------ [2009-01-13 05:36:57] daniel226 confirmed, php version 4.4.9 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://pear.php.net/bugs/bug.php?id=15602 -- Edit this bug report at http://pear.php.net/bugs/bug.php?id=15602&edit=1