PHP XML_Unserializer is removing some important characters

[dt84]

Hello Everyone,

This is a PHP/XML query.

I'm using XML_Unserializer from the PEAR package to convert some XML to a php array. The XML is very basic:

<response status="SUCCESS">
<object>some character data</object>
</response>

The problem I'm facing is that if "some character data" contains &lt; or &gt; (for < and >), these characters are being removed from the result.

"some character data" is usually HTML so what it needs to do is convert the &lt; and &gt; back to < and > rather than delete them.

I've looked through the XML_Unserializer code but haven't been able to determine when the characters are deleted.

Any help is greatly appreciated.

David.

[Dormilich]

when I used the wddx (de)serializer, it was converting the & of my entities to &amp; and back. it could be (tho I don't know the PEAR unserializer enough) your &lt; and &gt; are converted to < and > and then removed for security reasons???

you could test what happens to &amp;lt; maybe this can give you a hint....

[dt84]

Thanks Dormilich for the reply,

I tried it with "&amp;lt;" and the output was "lt;" so it appears XML_Unserializer is also not converting "&amp;" to "&".

Here's the code I'm using to test:

[PHP]
require_once('XML/Unserializer.php');

$some_text = '&lt;strong&gt;bold text&lt;strong&gt;';
$body = '<?xml version="1.0" encoding="UTF-8"?><response status="SUCCESS"><object>'.$some_text.'</object></response>';

$unserializer = new XML_Unserializer();
$result = $unserializer->unserialize($body);
if (!PEAR::isError($result)) {
$results = $unserializer->getUnserializedData();
if (empty($results)) {
echo 'EMPTY!';
}
else {
echo $results['object'];
}
}
else {
echo 'ERROR!';
}
[/PHP]

The above code should echo bold text but it's currently echoing "strongbold textstrong".

I'm not sure how to determine if it's a security issue.

David.

[Dormilich]

having a look at the docs, they call the unserializer
[PHP]XML_Unserializer::unserialize (string $data [, boolean $isFile = FALSE [, array $options = NULL]])
string XML_Unserializer::getUnserializedData ()[/PHP]
maybe you need to redefine some options?

[naznaz]

See http://forums.phpfreaks.com/topic/17...gt-from-cdata/