|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #79684 C14N sorts the attributes (incorrectly) when not loaded
Submitted: 2020-06-09 15:25 UTC Modified: 2020-06-10 11:33 UTC
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: and_spam+php_net at rump dot dk Assigned: cmb (profile)
Status: Not a bug Package: DOM XML related
PHP Version: 7.3.18 OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: and_spam+php_net at rump dot dk
New email:
PHP Version: OS:


 [2020-06-09 15:25 UTC] and_spam+php_net at rump dot dk
The test script perform the same operation twice but the result (the last two lines) are different depending on if the XML has been created dynamically or loaded (in this case by storing the dynamically created XML and (re)loading it).

You may reorder the createAttribute lines as you want but the last two lines will always be the same - the last line being correct.

Test script:
$xml = new DOMDocument();

$element = $xml->createElement('saml:Assertion');
$xml_saml_assertion = $xml->appendChild($element);
$attribute = $xml->createAttribute('id');
$attribute->value = 'IDCard';
$attribute = $xml->createAttribute('xmlns:saml');
$attribute->value = 'urn:oasis:names:tc:SAML:2.0:assertion';
$attribute = $xml->createAttribute('Version');
$attribute->value = '2.0';

print("<pre>" . htmlentities($xml->saveXML()) . "</pre><br>\n");
print("<pre>" . htmlentities($xml->C14N(TRUE)) . "</pre><br>\n");
print("<pre>" . htmlentities($xml->C14N(TRUE)) . "</pre><br>\n");

Expected result:
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" id="IDCard"></saml:Assertion>

Actual result:
<saml:Assertion Version="2.0" id="IDCard" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"></saml:Assertion>


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2020-06-09 16:29 UTC]
-Status: Open +Status: Not a bug -Assigned To: +Assigned To: cmb
 [2020-06-09 16:29 UTC]
Just adding the namespace declaration as normal attribute is not
supported.  You should instead create the `saml:Assertion` element
as node with associated namespace; see <>
for the correct code.
 [2020-06-09 18:01 UTC] and_spam+php_net at rump dot dk
It is a bug!

The XML was just the smallest sample I could create to prove the point.
I could create a full code as suggested but the result is exactly the same.

Please reopen and examine this ticket. I can provide way more code if you want to.
 [2020-06-09 21:44 UTC]
The DOM living standard states[1]:

| Return a new attribute whose local name is localName […]


| Attributes have a […] namespace prefix (null or a non-empty
| string), local name (a non-empty string) […]



creates an attribute with *local name* 'xmlns:saml', which is not
magically converted to a namespace declaration on the attribute's
element.  You can see that when you var_dump() the respective
attribute[3]; it's just a regular attribute with the localName
'xmlns:saml', and the namespace URI as testContent.  When you
convert this element to its textual representation, it looks like
its properly namespaced pendant, but it isn't quite the same
(unless reparsed).

[1] <>
[2] <>
[3] <>
 [2020-06-10 03:05 UTC] a at b dot c dot de
I for one am not seeing the difference between

<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" id="IDCard"></saml:Assertion>


<saml:Assertion Version="2.0" id="IDCard" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"></saml:Assertion>

I mean, the attributes are in a different order, but that has no significance, right?[1]

 [2020-06-10 07:48 UTC] and_spam+php_net at rump dot dk
You are totally correct [a at b dot c dot de] but also wrong. ;-)
C14N are used to extract the XML as a string just as saveXML but the content, incl. attributes, have to be in a specific order so the hash of the text always return the same result.
 [2020-06-10 11:33 UTC] and_spam+php_net at rump dot dk I stand corrected. Thanks. Sorry for not looking at your code example - I was to fast and just thought you were linking to some standard text.
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Wed May 12 00:01:24 2021 UTC