Exact

Exact Union RegExp

Niels Dossche 8f14f036c3 Sanitize libxml2 globals before parsing ... Fixes GHSA-3qrf-m4j2-pcrr. To parse a document with libxml2, you first need to create a parsing context. The parsing context contains parsing options (e.g. XML_NOENT to substitute entities) that the application (in this case PHP) can set. Unfortunately, libxml2 also supports providing default set options. For example, if you call xmlSubstituteEntitiesDefault(1) then the XML_NOENT option will be added to the parsing options every time you create a parsing context **even if the application never requested XML_NOENT**. Third party extensions can override these globals, in particular the substitute entity global. This causes entity substitution to be unexpectedly active. Fix it by setting the parsing options to a sane known value. For API calls that depend on global state we introduce PHP_LIBXML_SANITIZE_GLOBALS() and PHP_LIBXML_RESTORE_GLOBALS(). For other APIs that work directly with a context we introduce php_libxml_sanitize_parse_ctxt_options(). (cherry picked from commit c283c3ab0b)		2023-07-31 23:21:56 +03:00
..
tests	Merge branch 'PHP-8.1' into PHP-8.2	2023-05-06 23:10:58 +02:00
compat.c	Sanitize libxml2 globals before parsing	2023-07-31 23:21:56 +03:00
config.m4	Use a common setup macro to detect the Expat library	2019-06-04 10:10:50 +02:00
config.w32	Don't disable unrelated ext during configure	2021-09-20 10:26:33 +02:00
CREDITS
expat_compat.h	Update http->https in license (#6945)	2021-05-06 12:16:35 +02:00
php_xml.h	Declare ext/xml constants in stubs (#9131)	2022-07-25 21:31:24 +02:00
xml.c	Merge branch 'PHP-8.1' into PHP-8.2	2023-02-26 14:28:22 +00:00
xml.stub.php	Use true return type for XML functions which always return true	2022-09-23 13:22:13 +01:00
xml_arginfo.h	Use true return type for XML functions which always return true	2022-09-23 13:22:13 +01:00