Repository navigation
Conversation
iliaal
force-pushed
the
fix/xpath-callback-result-uaf-master
branch
from
November 9, 2026 21:33
587797a to
669f6bf
Compare
iliaal
changed the title
iliaal
force-pushed
the
fix/xpath-callback-result-uaf-master
branch
from
November 9, 2026 23:34
669f6bf to
2b1a1f4
Compare
A php:function() callback runs while libxml2 builds an XPath node-set, so modifying the tree or dropping the last reference to a detached subtree freed nodes the evaluation still referenced. While DOMXPath or Dom\XPath evaluates with PHP functions registered, the tree of the evaluated document, the tree of every node a callback returned and the detached subtrees of the context node and of callback arguments are read-only: modifying them throws a DOMException with NO_MODIFICATION_ALLOWED_ERR or, through SimpleXML, an Error, and the evaluation keeps those subtrees alive until it ends. New nodes and document properties stay modifiable.
iliaal
force-pushed
the
fix/xpath-callback-result-uaf-master
branch
from
November 10, 2026 00:42
2b1a1f4 to
4f5a047
Compare
iliaal
changed the title
Owner
Author
|
Submitted upstream as php#25357. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A php:function() callback of DOMXPath or Dom\XPath runs while libxml2 builds the node-set, so a callback that removes nodes, assigns textContent, removes attributes or drops the last reference to a detached subtree frees nodes the evaluation still uses. While such an evaluation runs, the trees it can reach are read-only, and modifying them throws a DOMException with NO_MODIFICATION_ALLOWED_ERR (an Error through SimpleXML). New nodes and document properties stay modifiable, so building and returning a fragment from a callback still works.
XSLT is split into a follow-up PR (fix/xpath-callback-mutation-refuse-xsl). Not covered: an id() node-set spanning two detached subtrees where a callback drops the last reference to the other one, and user error handlers during an evaluation with no PHP functions registered.