darylldoyle / svg-sanitizer

A PHP SVG/XML Sanitizer
GNU General Public License v2.0
456 stars 68 forks source link

Remove doctype node after node elements have been analyzed #52

Closed ohader closed 2 years ago

ohader commented 3 years ago

This is really a strange scenario - however in the end it occasionally caused segmentation faults...

vendor/bin/phpunit --no-coverage --filter=/doctypeAndEntityAreRemoved/
PHPUnit 6.5.14 by Sebastian Bergmann and contributors.

[1]    63007 segmentation fault  vendor/bin/phpunit --no-coverage --filter=/doctypeAndEntityAreRemoved/

PR #53 adds corresponding entityTest.svg (used in test-case doctypeAndEntityAreRemoved) which defined a XML entity using <!DOCTYPE fortiguard [ <!ENTITY lab "cool, text as an image">]>.

It turned out that the sequence of removing doctype, followed by \DOMXPath on the document causes a segmentation fault (at least on PHP 7.2 and 7.4, using libxml2 2.9.10 (always) and 2.9.12 (occasionally)). This is the call stack: