|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #78299 Custom entities in attributes are lost while importing
Submitted: 2019-07-16 09:02 UTC Modified: 2021-06-28 08:49 UTC
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:0 (0.0%)
From: fabian at leo dot org Assigned:
Status: Suspended Package: DOM XML related
PHP Version: 7.3.7 OS: Ubuntu 18.04
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2019-07-16 09:02 UTC] fabian at leo dot org
When importing a DomNode that contains a custom entity in one of it's attributes, into another DomDocument, the entity is missing from the output of getAttribute().

This is working if the custom entity is already present in the original document. e.g if you add a attribute hack="⟨" into the root element of the original document, the output of getAttribute on the imported DomNode is as expected "index.php?lang=en"

Test script:
// Creating document for import
$xml = <<<'XSL'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE xsl:stylesheet  [<!ENTITY lang "lang=en">]>
<ex:bla href="index.php?&lang;" xmlns:ex="" version="1.0"/>
$source = \DomDocument::loadXml($xml);

// Creating original document
$xml = <<<'XSL'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE xsl:stylesheet  [<!ENTITY lang "lang=en">]>
<xsl:stylesheet xmlns:xsl="" xmlns:ex="" version="1.0"/>
$doc1 = \DomDocument::loadXml($xml);

//echo $doc1->saveXml();  // xml is displayed correct
echo $doc1->documentElement->firstChild->getAttribute("href"); // getAttribute() is not working: "index.php?"

Expected result:

Actual result:


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2019-10-02 16:19 UTC] rauldmiller at gmail dot com
Note that this also hits elements which do not follow xml formalisms, such as
 [2021-06-28 08:49 UTC]
-Status: Open +Status: Suspended
 [2021-06-28 08:49 UTC]
This looks like an issue in libxml2.  I've written to their
mailing list[1], and suspend this ticket for the time being.

[1] <>
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Apr 24 20:01:32 2024 UTC