#26528 [NEW]: xml_parse_into_struct does not unescape attribute values

[archie at dellroad dot org]

From:             archie at dellroad dot org
Operating system: Linux redhat 9
PHP version:      5.0.0b2 (beta2)
PHP Bug Type:     XML related
Bug description:  xml_parse_into_struct does not unescape attribute values

Description:
------------
When the function xml_parse_into_struct() is used,
XML attribute values that contain escaped characters
in them are not properly un-escaped.

E.g. suppose the tag is:

  <governor name="Jesse &quot;The Body&quot; Ventura"/>

Then the attribute is returned still escaped, as

  Jesse &quot;The Body&quot; Ventura

rather than

  Jesse "The Body" Ventura

like it should be.

This function is supposed to parse
the XML, and &-encodings are part of XML, so it should
properly decode them!

Here's ldd output for my test version of PHP:

$ ldd ~/php-5.0.0b2/sapi/cli/php
        libcrypt.so.1 => /lib/libcrypt.so.1 (0x40017000)
        librt.so.1 => /lib/i686/librt.so.1 (0x40064000)
        libm.so.6 => /lib/i686/libm.so.6 (0x4007f000)
        libmysqlclient.so.10 => /usr/lib/mysql/libmysqlclient.so.10
(0x400cc000)        libresolv.so.2 => /lib/libresolv.so.2 (0x40103000)
        libdl.so.2 => /lib/libdl.so.2 (0x40116000)
        libnsl.so.1 => /lib/libnsl.so.1 (0x4011a000)
        libz.so.1 => /usr/lib/libz.so.1 (0x40140000)
        libxml2.so.2 => /usr/local/lib/libxml2.so.2 (0x4014e000)
        libpthread.so.0 => /lib/i686/libpthread.so.0 (0x40237000)
        libc.so.6 => /lib/i686/libc.so.6 (0x40287000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)




Reproduce code:
---------------
<?php
$sample =
  "<?xml version=\"1.0\"?><test attr=\"angle&lt;bracket\"/>";
$parser = xml_parser_create();
$res = xml_parse_into_struct($parser,$sample,$vals,$index);
xml_parser_free($parser);
var_dump($vals); 
?>


Expected result:
----------------
array(1) {
  [0]=>
  array(4) {
    ["tag"]=>
    string(4) "TEST"
    ["type"]=>
    string(8) "complete"
    ["level"]=>
    int(1)
    ["attributes"]=>
    array(1) {
      ["ATTR"]=>
      string(16) "angle<bracket"
    }
  }
}


Actual result:
--------------
array(1) {
  [0]=>
  array(4) {
    ["tag"]=>
    string(4) "TEST"
    ["type"]=>
    string(8) "complete"
    ["level"]=>
    int(1)
    ["attributes"]=>
    array(1) {
      ["ATTR"]=>
      string(16) "angle&lt;bracket"
    }
  }
}



-- 
Edit bug report at http://bugs.php.net/?id=26528&edit=1
-- 
Try a CVS snapshot (php4):  http://bugs.php.net/fix.php?id=26528&r=trysnapshot4
Try a CVS snapshot (php5):  http://bugs.php.net/fix.php?id=26528&r=trysnapshot5
Fixed in CVS:               http://bugs.php.net/fix.php?id=26528&r=fixedcvs
Fixed in release:           http://bugs.php.net/fix.php?id=26528&r=alreadyfixed
Need backtrace:             http://bugs.php.net/fix.php?id=26528&r=needtrace
Need Reproduce Script:      http://bugs.php.net/fix.php?id=26528&r=needscript
Try newer version:          http://bugs.php.net/fix.php?id=26528&r=oldversion
Not developer issue:        http://bugs.php.net/fix.php?id=26528&r=support
Expected behavior:          http://bugs.php.net/fix.php?id=26528&r=notwrong
Not enough info:            http://bugs.php.net/fix.php?id=26528&r=notenoughinfo
Submitted twice:            http://bugs.php.net/fix.php?id=26528&r=submittedtwice
register_globals:           http://bugs.php.net/fix.php?id=26528&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=26528&r=php3
Daylight Savings:           http://bugs.php.net/fix.php?id=26528&r=dst
IIS Stability:              http://bugs.php.net/fix.php?id=26528&r=isapi
Install GNU Sed:            http://bugs.php.net/fix.php?id=26528&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=26528&r=float