php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #79210 WSDL maxOccurs/minOccurs attributes are ignored when set in 'sequence' node
Submitted: 2020-02-01 23:16 UTC Modified: 2020-02-02 01:39 UTC
Votes:6
Avg. Score:4.8 ± 0.4
Reproduced:5 of 5 (100.0%)
Same Version:0 (0.0%)
Same OS:1 (20.0%)
From: carlos dot godo at outlook dot com Assigned:
Status: Open Package: SOAP related
PHP Version: 7.2.27 OS: ubuntu18.04
Private report: No CVE-ID: None
View Developer Edit
 [2020-02-01 23:16 UTC] carlos dot godo at outlook dot com 
Description:
------------
When parsing WSDL, SoapClient ignores maxOccurs or minOccurs attributes when they are set on the 'sequence' node, instead of on the 'element' node.

Below there's an example of a WSDL type that causes the issue. See that the 'sequence' element for "persons" has maxOccurs="unbounded".

<element name="persons">
    <complexType>
        <sequence maxOccurs="unbounded">
            <element name="person">
                <complexType>
                    <sequence>
                        <element name="full_name" type="xsd:string"/>
                    </sequence>
                </complexType>
            </element>
        </sequence>
    </complexType>
</element>

The data that would match this complexType would be:

$data = (object)[
    'persons' => (object)[
        'person' => [
            (object)['full_name' => 'Person One'],
            (object)['full_name' => 'Person Two'],
            (object)['full_name' => 'Person Three'],
        ]
    ],
];

However, since maxOccurs is ignored, SoapClient expects "person" to be an object containing a 'full_name' property. Since instead it finds an array, it fails with the following error:

SOAP-ERROR: Encoding: object has no 'full_name' property.

Expected result:
----------------
<persons>
    <person>
         <full_name>Person One</full_name>
    </person>
    <person>
         <full_name>Person Two</full_name>
    </person>
    <person>
         <full_name>Person Three</full_name>
    </person>
</persons>

Actual result:
--------------
SOAP-ERROR: Encoding: object has no 'full_name' property

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-02-01 23:25 UTC] requinix@php.net
-Status: Open +Status: Duplicate
 [2020-02-01 23:25 UTC] requinix@php.net 
Duplicate of bug #78749
 [2020-02-02 00:28 UTC] carlos dot godo at outlook dot com 
I disagree about this being a duplicate of the other bug just because it also talks about maxOccurs.

This bug talks about maxOccurs/minOccurs being ignored if it is set in the 'sentence' node. Meaning SoapClient won't accept an array as input when it should.

In the other bug maxOccurs does not validate the number elements if set >1. It has nothing to do with this apart of talking about the same attribute.
 [2020-02-02 01:00 UTC] requinix@php.net
-Status: Duplicate +Status: Open
 [2020-02-02 01:00 UTC] requinix@php.net 
Yes, you are right. There is a distinct issue here about maxOccurs only being respected for <element>s and <any>s, and not <sequence>s or other types.

In the case of a sequence with one element, the obvious workaround is to put maxOccurs on the element. For more than one element, I'm not sure.
 [2020-02-02 01:21 UTC] carlos dot godo at outlook dot com 
Thanks for reviewing. 

For more than one element, my guess is that maxOccurs/minOccurs attributes apply to all child elements of the sequence that do not specify their own attributes.

Yes, modifying the schema would be the easiest workaround. In my case that schema belongs to an external API, so I'll have to download the schema, parse it and fix it locally before consuming the API.
 [2020-02-02 01:39 UTC] requinix@php.net 
> For more than one element, my guess is that maxOccurs/minOccurs attributes apply to all child elements of the
> sequence that do not specify their own attributes.
A sequence is a type of grouping, and a sequence of minOccurs>1 means literally to repeat the group.

<sequence minOccurs="2">
  <element name="first_name" />
  <element name="last_name" />
</sequence>

corresponds to

<first_name />
<last_name />
<first_name />
<last_name />

and

<sequence>
  <element name="first_name" minOccurs="2" />
  <element name="last_name" minOccurs="2" />
</sequence>

corresponds to

<first_name />
<first_name />
<last_name />
<last_name />

Remember that ordering is significant in XML: those two outputs are technically not the same thing, and validating one against an XSD of the other would fail.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Wed Nov 05 14:00:01 2025 UTC