From e68acd031db679ff882710ce89bfac67e65bd9f0 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Wed, 7 Oct 2020 12:45:43 +0200
Subject: [PATCH] Fix #77040: tidyNode::isHtml() is completely broken

The documentation of `tidyNode::isHtml()` states that this method
"checks if a node is part of a HTML document".  That is, of course,
nonsense, since a tidyNode is "an HTML node in an HTML file, as
detected by tidy."

What this method is actually supposed to do is to check whether a node
is an element (unless it is the root element).  This has been broken by
commit d8eeb8e[1], which assumed that `enum TidyNodeType` would
represent flags of a bitmask, what it does not.

[1] <http://git.php.net/?p=php-src.git;a=commit;h=d8eeb8e28673236bca3f066ded75037a5bdf6378>

Closes GH-6290.
---
 NEWS                         |  3 +++
 ext/tidy/tests/bug77040.phpt | 27 +++++++++++++++++++++++++++
 ext/tidy/tidy.c              | 11 +++++++----
 3 files changed, 37 insertions(+), 4 deletions(-)
 create mode 100644 ext/tidy/tests/bug77040.phpt

diff --git a/NEWS b/NEWS
index c7e278e3cd9..17a77b34605 100644
--- a/NEWS
+++ b/NEWS
@@ -35,6 +35,9 @@ PHP                                                                        NEWS
   . Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors). (cmb)
   . Fixed bug #76735 (Incorrect message in fopen on invalid mode). (cmb)
 
+- Tidy:
+  . Fixed bug #77040 (tidyNode::isHtml() is completely broken). (cmb)
+
 01 Oct 2020, PHP 7.3.23
 
 - Core:
diff --git a/ext/tidy/tests/bug77040.phpt b/ext/tidy/tests/bug77040.phpt
new file mode 100644
index 00000000000..a1af00bdfb7
--- /dev/null
+++ b/ext/tidy/tests/bug77040.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #77040 (tidyNode::isHtml() is completely broken)
+--SKIPIF--
+<?php
+if (!extension_loaded('tidy')) die('skip tidy extension not available');
+?>
+--FILE--
+<?php
+$tidy = new tidy;
+$tidy->parseString("<p>text</p><p><![CDATA[cdata]]></p>");
+$p = $tidy->body()->child[0];
+var_dump($p->type === TIDY_NODETYPE_START);
+var_dump($p->isHtml());
+$text = $p->child[0];
+var_dump($text->type === TIDY_NODETYPE_TEXT);
+var_dump($text->isHtml());
+$cdata = $tidy->body()->child[1]->child[0];
+var_dump($cdata->type === TIDY_NODETYPE_CDATA);
+var_dump($cdata->isHtml());
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
+bool(false)
+bool(true)
+bool(false)
\ No newline at end of file
diff --git a/ext/tidy/tidy.c b/ext/tidy/tidy.c
index 0fde23cb11b..60170585ce5 100644
--- a/ext/tidy/tidy.c
+++ b/ext/tidy/tidy.c
@@ -1786,11 +1786,14 @@ static TIDY_NODE_METHOD(isHtml)
 {
 	TIDY_FETCH_ONLY_OBJECT;
 
-	if (tidyNodeGetType(obj->node) & (TidyNode_Start | TidyNode_End | TidyNode_StartEnd)) {
-		RETURN_TRUE;
+	switch (tidyNodeGetType(obj->node)) {
+		case TidyNode_Start:
+		case TidyNode_End:
+		case TidyNode_StartEnd:
+			RETURN_TRUE;
+		default:
+			RETURN_FALSE;
 	}
-
-	RETURN_FALSE;
 }
 /* }}} */