[GIT-PULLS] [php-src] PR #23069: Reject embedded NUL in SimpleXMLElement path/URL constructor
[email protected] (iliaal)
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/23069
Author: iliaal
With dataIsURL set, SimpleXMLElement::__construct hands its first argument to xmlReadFile as a C string, so `new SimpleXMLElement("/tmp/ok.xml\0anything", 0, true)` quietly loads /tmp/ok.xml. simplexml_load_file already rejects this because its filename parameter is declared as a path; the constructor takes a plain string and never runs the check. The constructor now throws the same ValueError before reaching xmlReadFile.