php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #39493 simplexml_load_file does not obey default stream context
Submitted: 2006-11-13 10:14 UTC Modified: 2006-11-13 14:09 UTC
From: RQuadling at GMail dot com Assigned:
Status: Not a bug Package: SimpleXML related
PHP Version: 5CVS-2006-11-13 (snap) OS: Windows XP SP2
Private report: No CVE-ID: None
 [2006-11-13 10:14 UTC] RQuadling at GMail dot com
Description:
------------
I'm behind a MS ISA server using NTLM Authentication which is unsupported by PHP.

To allow PHP through, I use Python and the NTLM Authentication Proxy Server (further details for this at http://rquadling.php1h.com).

I then use an auto_prepend_file entry to include a default context assignment to route http traffic to my the proxy.

This works fine for both CLI and ISAPI operations.

The simplexml_load_file() function does not have a context facility. It also does not use the same mechanism to get data OR it is ignoring the default context setup.

The example code is just to show the error.

If you are NOT using contexts or you are have direct access to the outside world, then you will not see the problem.

My NTLM APS logs do not show 2 requests to the external data. Only 1 - the file_get_contents() call.



Reproduce code:
---------------
<?php
// Define the default, system-wide context. - COPIED FROM auto_prepended_file.php
$r_default_context = stream_context_get_default
	(
	array
		(
		'http' => array
			( // All HTTP requests are passed through the local NTLM proxy server on port 8080.
			'proxy' => 'tcp://127.0.0.1:8080',
			'request_fulluri' => True,
			),
		)
	);

echo file_get_contents('http://www.people.com.cn/rss/politics.xml');
$xml = simplexml_load_file('http://www.people.com.cn/rss/politics.xml');
?>

Expected result:
----------------
<?xml version="1.0" encoding="GB2312"?>
<rss version="2.0">
<channel>
<title>&#9571;?&#9472;&#9484;?&#9516;&#9580;&#9532;</title>
<link>http://politics.people.com.cn</link>
<language>zh_CN</language>
<copyright>Copyright ? 1997-2006 by www.people.com.cn. all rights reserved</copyright>
<pubDate>2006-11-13 16:40:00</pubDate>

[SNIP]

<pubDate>2006-11-13 16:43:03</pubDate>
</item>
</channel>
</rss>


Actual result:
--------------
<?xml version="1.0" encoding="GB2312"?>
<rss version="2.0">
<channel>
<title>&#9571;?&#9472;&#9484;?&#9516;&#9580;&#9532;</title>
<link>http://politics.people.com.cn</link>
<language>zh_CN</language>
<copyright>Copyright ? 1997-2006 by www.people.com.cn. all rights reserved</copyright>
<pubDate>2006-11-13 16:40:00</pubDate>

[SNIP]

<pubDate>2006-11-13 16:43:03</pubDate>
</item>
</channel>
</rss>

Warning: simplexml_load_file(http://www.people.com.cn/rss/politics.xml): failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden ( The ISA Server denies the specified Uniform Resource Locator (URL).  )
 in C:\noCX.php on line 16

Warning: simplexml_load_file(): I/O warning : failed to load external entity "http://www.people.com.cn/rss/politics.xml" in C:\noCX.php on line 16

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2006-11-13 10:29 UTC] tony2001@php.net
simplexml_load_file() is just a wrapper for libxml2 functions, which apparently know nothing about stream context etc.

 [2006-11-13 14:09 UTC] RQuadling at GMail dot com
What about open_basedir, and other file access restrictions?

Is it possible that all the security used within PHP can be bypassed using this library?

A potential security risk surely!

But, as you mentioned libxml, this can be solved by using libxml_set_streams_context.

So, whereas I've got ...
$r_default_context = stream_context_get_default
	(
	array
		(
		'http' => array
			(
			'proxy' => 'tcp://127.0.0.1:8080',
			'request_fulluri' => True,
			),
		)
	);

I can add ...

libxml_set_streams_context($r_default_context);

I think.

Testing ...

Yep!

I'll be adding a user notes relating to this as it stumped me!

Thanks for the help.

Maybe, with windows being used more and more for PHP, this should be a documentation issue?
 [2013-04-21 12:01 UTC] hanskrentel at yahoo dot de
I know this feedback is later, to whom it may concern: Setting the stream context 
in libxml is possible via:

    libxml_set_streams_context()

See http://php.net/libxml_set_streams_context for more information. This is 
probably still worth to have this documented here in the issue tracker.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Apr 19 20:01:29 2024 UTC