diff --git a/NEWS b/NEWS index 519b0ccaf053..cf8ac1f9fdf2 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,8 @@ PHP NEWS return value of php_cli_server_client_send_through()). (Lazizbek Ergashev) - DOM: + . Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching + the null namespace in spec-following mode. (iliaal) . Fixed a use-after-free when cloning a DOMNameSpaceNode after DOMDocument::xinclude(). (iliaal) . Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children diff --git a/ext/dom/namednodemap.c b/ext/dom/namednodemap.c index bc867aba4384..68118a2e300f 100644 --- a/ext/dom/namednodemap.c +++ b/ext/dom/namednodemap.c @@ -213,6 +213,9 @@ PHP_METHOD(DOMNamedNodeMap, getNamedItemNS) objmap = (dom_nnodemap_object *)intern->ptr; if (objmap != NULL) { + if (urilen == 0 && objmap->baseobj != NULL && objmap->nodetype != XML_NOTATION_NODE && objmap->nodetype != XML_ENTITY_NODE && php_dom_follow_spec_intern(objmap->baseobj)) { + uri = NULL; + } if ((objmap->nodetype == XML_NOTATION_NODE) || objmap->nodetype == XML_ENTITY_NODE) { if (objmap->ht) { diff --git a/ext/dom/tests/getNamedItemNS_empty_uri.phpt b/ext/dom/tests/getNamedItemNS_empty_uri.phpt new file mode 100644 index 000000000000..17d0659678e6 --- /dev/null +++ b/ext/dom/tests/getNamedItemNS_empty_uri.phpt @@ -0,0 +1,25 @@ +--TEST-- +getNamedItemNS() with an empty URI must look up the null namespace +--EXTENSIONS-- +dom +--FILE-- +loadXML(''); +$a = $d->documentElement->attributes->getNamedItemNS('', 'bar'); +var_dump($a === null ? null : $a->nodeValue); +$b = $d->documentElement->attributes->getNamedItemNS('urn:q', 'bar'); +var_dump($b === null ? null : $b->nodeValue); +$d2 = Dom\XMLDocument::createFromString(''); +$a2 = $d2->documentElement->attributes->getNamedItemNS('', 'bar'); +var_dump($a2 === null ? null : $a2->nodeValue); +var_dump($d2->documentElement->hasAttributeNS('', 'bar')); +$c = $d2->documentElement->attributes->getNamedItemNS('urn:q', 'bar'); +var_dump($c === null ? null : $c->nodeValue); +?> +--EXPECT-- +NULL +string(2) "ns" +string(5) "no-ns" +bool(true) +string(2) "ns"