doc-en icon indicating copy to clipboard operation
doc-en copied to clipboard

LIBXML_XINCLUDE is not supported, should be documented

Open hannob opened this issue 2 months ago • 0 comments

Affected page

https://www.php.net/manual/en/libxml.constants.php#constant.libxml-xinclude

Issue description

The PHP documentation mentions the LIBXML_XINCLUDE constant to enable XInclude support in XML parsing here: https://www.php.net/manual/en/libxml.constants.php#constant.libxml-xinclude

However it does not appear to work. I am not entirely sure whether this is intentional (then it would be a documentation issue) or whether there's an expectation for it to work (then it should be considered a bug in the code).

I imagine it might be intentional, as Xinclude is a rarely used and potentially very dangerous feature, so I will report it here, assuming it should be properly documented.

Note that this has already been mentioned in a comment here a long time ago: https://www.php.net/manual/en/function.simplexml-load-string.php#77713

Here's example code that should output the content of /etc/passwd (and does not do that):

#!/usr/bin/php
<?php

$xmlcontent = <<<EOF
<x xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include parse="text" href="file:///etc/passwd"/>
</x>
EOF;

$sx = new SimpleXMLElement($xmlcontent, LIBXML_XINCLUDE);

print($sx->asXML());


### Steps to reproduce

1. Go to
https://www.php.net/manual/en/libxml.constants.php#constant.libxml-xinclude
2. Try to write code using simplexml and that constant
3. does not include anything

### Suggested fix

Either documentation should mention that this is effectively unsupported and a NOOP or it should be supported (if so, please add a warning in the docs that it can be dangerous due to XXE attacks).

hannob avatar Nov 17 '25 10:11 hannob