3 namespace PhpXmlRpc\Helper;
5 use PhpXmlRpc\PhpXmlRpc;
9 * Deals with parsing the XML.
13 const RETURN_XMLRPCVALS = 'xmlrpcvals';
14 const RETURN_PHP = 'phpvals';
16 const ACCEPT_REQUEST = 1;
17 const ACCEPT_RESPONSE = 2;
18 const ACCEPT_VALUE = 4;
20 // Used to store state during parsing.
21 // Quick explanation of components:
23 // ac - used to accumulate values
24 // stack - array with genealogy of xml elements names used to validate nesting of xmlrpc elements
25 // valuestack - array used for parsing arrays and structs
26 // lv - used to indicate "looking for a value": implements the logic to allow values with no types to be strings
28 // isf - used to indicate an xml parsing fault (3), invalid xmlrpc fault (2) or xmlrpc response fault (1)
29 // isf_reason - used for storing xmlrpc response fault string
30 // method - used to store method name
31 // params - used to store parameters in method calls
32 // pt - used to store the type of each received parameter. Useful if parameters are automatically decoded to php values
33 // rt - 'methodcall', 'methodresponse' or 'value'
37 'valuestack' => array(),
46 public $xmlrpc_valid_parents = array(
47 'VALUE' => array('MEMBER', 'DATA', 'PARAM', 'FAULT'),
48 'BOOLEAN' => array('VALUE'),
49 'I4' => array('VALUE'),
50 'I8' => array('VALUE'),
51 'EX:I8' => array('VALUE'),
52 'INT' => array('VALUE'),
53 'STRING' => array('VALUE'),
54 'DOUBLE' => array('VALUE'),
55 'DATETIME.ISO8601' => array('VALUE'),
56 'BASE64' => array('VALUE'),
57 'MEMBER' => array('STRUCT'),
58 'NAME' => array('MEMBER'),
59 'DATA' => array('ARRAY'),
60 'ARRAY' => array('VALUE'),
61 'STRUCT' => array('VALUE'),
62 'PARAM' => array('PARAMS'),
63 'METHODNAME' => array('METHODCALL'),
64 'PARAMS' => array('METHODCALL', 'METHODRESPONSE'),
65 'FAULT' => array('METHODRESPONSE'),
66 'NIL' => array('VALUE'), // only used when extension activated
67 'EX:NIL' => array('VALUE'), // only used when extension activated
70 /** @var array $parsing_options */
71 protected $parsing_options = array();
72 /** @var int $accept self::ACCEPT_REQUEST | self::ACCEPT_RESPONSE by default */
73 protected $accept = 3;
74 /** @var int $maxChunkLength 4 MB by default. Any value below 10MB should be good */
75 protected $maxChunkLength = 4194304;
78 * @param array $options passed to the xml parser
80 public function __construct(array $options = array())
82 $this->parsing_options = $options;
87 * @param string $returnType
88 * @param int $accept a bit-combination of self::ACCEPT_REQUEST, self::ACCEPT_RESPONSE, self::ACCEPT_VALUE
91 public function parse($data, $returnType = self::RETURN_XMLRPCVALS, $accept = 3)
96 'valuestack' => array(),
99 'method' => false, // so we can check later if we got a methodname or not
105 $len = strlen($data);
107 // we test for empty documents here to save on resource allocation and simply the chunked-parsing loop below
109 $this->_xh['isf'] = 3;
110 $this->_xh['isf_reason'] = 'XML error 5: empty document';
114 $parser = xml_parser_create();
116 foreach ($this->parsing_options as $key => $val) {
117 xml_parser_set_option($parser, $key, $val);
119 // always set this, in case someone tries to disable it via options...
120 xml_parser_set_option($parser, XML_OPTION_CASE_FOLDING, 1);
122 xml_set_object($parser, $this);
124 if ($returnType == self::RETURN_PHP) {
125 xml_set_element_handler($parser, 'xmlrpc_se', 'xmlrpc_ee_fast');
127 xml_set_element_handler($parser, 'xmlrpc_se', 'xmlrpc_ee');
130 xml_set_character_data_handler($parser, 'xmlrpc_cd');
131 xml_set_default_handler($parser, 'xmlrpc_dh');
133 $this->accept = $accept;
135 // @see ticket #70 - we have to parse big xml docks in chunks to avoid errors
136 for ($offset = 0; $offset < $len; $offset += $this->maxChunkLength) {
137 $chunk = substr($data, $offset, $this->maxChunkLength);
138 // error handling: xml not well formed
139 if (!xml_parse($parser, $chunk, $offset + $this->maxChunkLength >= $len)) {
140 $errCode = xml_get_error_code($parser);
141 $errStr = sprintf('XML error %s: %s at line %d, column %d', $errCode, xml_error_string($errCode),
142 xml_get_current_line_number($parser), xml_get_current_column_number($parser));
144 $this->_xh['isf'] = 3;
145 $this->_xh['isf_reason'] = $errStr;
150 xml_parser_free($parser);
154 * xml parser handler function for opening element tags.
155 * @param resource $parser
156 * @param string $name
158 * @param bool $acceptSingleVals DEPRECATED use the $accept parameter instead
160 public function xmlrpc_se($parser, $name, $attrs, $acceptSingleVals = false)
162 // if invalid xmlrpc already detected, skip all processing
163 if ($this->_xh['isf'] < 2) {
165 // check for correct element nesting
166 if (count($this->_xh['stack']) == 0) {
167 // top level element can only be of 2 types
168 /// @todo optimization creep: save this check into a bool variable, instead of using count() every time:
169 /// there is only a single top level element in xml anyway
171 if ($acceptSingleVals === false) {
172 $accept = $this->accept;
174 $accept = self::ACCEPT_REQUEST | self::ACCEPT_RESPONSE | self::ACCEPT_VALUE;
176 if (($name == 'METHODCALL' && ($accept & self::ACCEPT_REQUEST)) ||
177 ($name == 'METHODRESPONSE' && ($accept & self::ACCEPT_RESPONSE)) ||
178 ($name == 'VALUE' && ($accept & self::ACCEPT_VALUE))) {
179 $this->_xh['rt'] = strtolower($name);
181 $this->_xh['isf'] = 2;
182 $this->_xh['isf_reason'] = 'missing top level xmlrpc element. Found: ' . $name;
187 // not top level element: see if parent is OK
188 $parent = end($this->_xh['stack']);
189 if (!array_key_exists($name, $this->xmlrpc_valid_parents) || !in_array($parent, $this->xmlrpc_valid_parents[$name])) {
190 $this->_xh['isf'] = 2;
191 $this->_xh['isf_reason'] = "xmlrpc element $name cannot be child of $parent";
198 // optimize for speed switch cases: most common cases first
200 /// @todo we could check for 2 VALUE elements inside a MEMBER or PARAM element
201 $this->_xh['vt'] = 'value'; // indicator: no value found yet
202 $this->_xh['ac'] = '';
203 $this->_xh['lv'] = 1;
204 $this->_xh['php_class'] = null;
208 if (PHP_INT_SIZE === 4) {
209 // INVALID ELEMENT: RAISE ISF so that it is later recognized!!!
210 $this->_xh['isf'] = 2;
211 $this->_xh['isf_reason'] = "Received i8 element but php is compiled in 32 bit mode";
215 // fall through voluntarily
221 case 'DATETIME.ISO8601':
223 if ($this->_xh['vt'] != 'value') {
224 // two data elements inside a value: an error occurred!
225 $this->_xh['isf'] = 2;
226 $this->_xh['isf_reason'] = "$name element following a {$this->_xh['vt']} element inside a single value";
230 $this->_xh['ac'] = ''; // reset the accumulator
234 if ($this->_xh['vt'] != 'value') {
235 // two data elements inside a value: an error occurred!
236 $this->_xh['isf'] = 2;
237 $this->_xh['isf_reason'] = "$name element following a {$this->_xh['vt']} element inside a single value";
241 // create an empty array to hold child values, and push it onto appropriate stack
243 $curVal['values'] = array();
244 $curVal['type'] = $name;
245 // check for out-of-band information to rebuild php objs
246 // and in case it is found, save it
247 if (@isset($attrs['PHP_CLASS'])) {
248 $curVal['php_class'] = $attrs['PHP_CLASS'];
250 $this->_xh['valuestack'][] = $curVal;
251 $this->_xh['vt'] = 'data'; // be prepared for a data element next
254 if ($this->_xh['vt'] != 'data') {
255 // two data elements inside a value: an error occurred!
256 $this->_xh['isf'] = 2;
257 $this->_xh['isf_reason'] = "found two data elements inside an array element";
262 case 'METHODRESPONSE':
264 // valid elements that add little to processing
268 /// @todo we could check for 2 NAME elements inside a MEMBER element
269 $this->_xh['ac'] = '';
272 $this->_xh['isf'] = 1;
275 // set member name to null, in case we do not find in the xml later on
276 $this->_xh['valuestack'][count($this->_xh['valuestack']) - 1]['name'] = '';
277 //$this->_xh['ac']='';
278 // Drop trough intentionally
280 // clear value type, so we can check later if no value has been passed for this param/member
281 $this->_xh['vt'] = null;
285 if (PhpXmlRpc::$xmlrpc_null_extension) {
286 if ($this->_xh['vt'] != 'value') {
287 // two data elements inside a value: an error occurred!
288 $this->_xh['isf'] = 2;
289 $this->_xh['isf_reason'] = "$name element following a {$this->_xh['vt']} element inside a single value";
293 $this->_xh['ac'] = ''; // reset the accumulator
296 // we do not support the <NIL/> extension, so
297 // drop through intentionally
299 /// INVALID ELEMENT: RAISE ISF so that it is later recognized!!!
300 $this->_xh['isf'] = 2;
301 $this->_xh['isf_reason'] = "found not-xmlrpc xml element $name";
305 // Save current element name to stack, to validate nesting
306 $this->_xh['stack'][] = $name;
308 /// @todo optimization creep: move this inside the big switch() above
309 if ($name != 'VALUE') {
310 $this->_xh['lv'] = 0;
316 * xml parser handler function for opening element tags.
317 * Used in decoding xml chunks that might represent single xmlrpc values as well as requests, responses.
319 * @param resource $parser
323 public function xmlrpc_se_any($parser, $name, $attrs)
325 $this->xmlrpc_se($parser, $name, $attrs, true);
329 * xml parser handler function for close element tags.
330 * @param resource $parser
331 * @param string $name
332 * @param bool $rebuildXmlrpcvals
334 public function xmlrpc_ee($parser, $name, $rebuildXmlrpcvals = true)
336 if ($this->_xh['isf'] < 2) {
337 // push this element name from stack
338 // NB: if XML validates, correct opening/closing is guaranteed and
339 // we do not have to check for $name == $currElem.
340 // we also checked for proper nesting at start of elements...
341 $currElem = array_pop($this->_xh['stack']);
345 // This if() detects if no scalar was inside <VALUE></VALUE>
346 if ($this->_xh['vt'] == 'value') {
347 $this->_xh['value'] = $this->_xh['ac'];
348 $this->_xh['vt'] = Value::$xmlrpcString;
351 if ($rebuildXmlrpcvals) {
352 // build the xmlrpc val out of the data received, and substitute it
353 $temp = new Value($this->_xh['value'], $this->_xh['vt']);
354 // in case we got info about underlying php class, save it
355 // in the object we're rebuilding
356 if (isset($this->_xh['php_class'])) {
357 $temp->_php_class = $this->_xh['php_class'];
359 // check if we are inside an array or struct:
360 // if value just built is inside an array, let's move it into array on the stack
361 $vscount = count($this->_xh['valuestack']);
362 if ($vscount && $this->_xh['valuestack'][$vscount - 1]['type'] == 'ARRAY') {
363 $this->_xh['valuestack'][$vscount - 1]['values'][] = $temp;
365 $this->_xh['value'] = $temp;
368 /// @todo this needs to treat correctly php-serialized objects,
369 /// since std deserializing is done by php_xmlrpc_decode,
370 /// which we will not be calling...
371 if (isset($this->_xh['php_class'])) {
374 // check if we are inside an array or struct:
375 // if value just built is inside an array, let's move it into array on the stack
376 $vscount = count($this->_xh['valuestack']);
377 if ($vscount && $this->_xh['valuestack'][$vscount - 1]['type'] == 'ARRAY') {
378 $this->_xh['valuestack'][$vscount - 1]['values'][] = $this->_xh['value'];
389 case 'DATETIME.ISO8601':
391 $this->_xh['vt'] = strtolower($name);
392 /// @todo: optimization creep - remove the if/elseif cycle below
393 /// since the case() in which we are already did that
394 if ($name == 'STRING') {
395 $this->_xh['value'] = $this->_xh['ac'];
396 } elseif ($name == 'DATETIME.ISO8601') {
397 if (!preg_match('/^[0-9]{8}T[0-9]{2}:[0-9]{2}:[0-9]{2}$/', $this->_xh['ac'])) {
398 error_log('XML-RPC: ' . __METHOD__ . ': invalid value received in DATETIME: ' . $this->_xh['ac']);
400 $this->_xh['vt'] = Value::$xmlrpcDateTime;
401 $this->_xh['value'] = $this->_xh['ac'];
402 } elseif ($name == 'BASE64') {
403 /// @todo check for failure of base64 decoding / catch warnings
404 $this->_xh['value'] = base64_decode($this->_xh['ac']);
405 } elseif ($name == 'BOOLEAN') {
406 // special case here: we translate boolean 1 or 0 into PHP
407 // constants true or false.
408 // Strings 'true' and 'false' are accepted, even though the
409 // spec never mentions them (see eg. Blogger api docs)
410 // NB: this simple checks helps a lot sanitizing input, ie no
411 // security problems around here
412 if ($this->_xh['ac'] == '1' || strcasecmp($this->_xh['ac'], 'true') == 0) {
413 $this->_xh['value'] = true;
415 // log if receiving something strange, even though we set the value to false anyway
416 if ($this->_xh['ac'] != '0' && strcasecmp($this->_xh['ac'], 'false') != 0) {
417 error_log('XML-RPC: ' . __METHOD__ . ': invalid value received in BOOLEAN: ' . $this->_xh['ac']);
419 $this->_xh['value'] = false;
421 } elseif ($name == 'DOUBLE') {
423 // we must check that only 0123456789-.<space> are characters here
424 // NOTE: regexp could be much stricter than this...
425 if (!preg_match('/^[+-eE0123456789 \t.]+$/', $this->_xh['ac'])) {
426 /// @todo: find a better way of throwing an error than this!
427 error_log('XML-RPC: ' . __METHOD__ . ': non numeric value received in DOUBLE: ' . $this->_xh['ac']);
428 $this->_xh['value'] = 'ERROR_NON_NUMERIC_FOUND';
430 // it's ok, add it on
431 $this->_xh['value'] = (double)$this->_xh['ac'];
434 // we have an I4/I8/INT
435 // we must check that only 0123456789-<space> are characters here
436 if (!preg_match('/^[+-]?[0123456789 \t]+$/', $this->_xh['ac'])) {
437 /// @todo find a better way of throwing an error than this!
438 error_log('XML-RPC: ' . __METHOD__ . ': non numeric value received in INT: ' . $this->_xh['ac']);
439 $this->_xh['value'] = 'ERROR_NON_NUMERIC_FOUND';
441 // it's ok, add it on
442 $this->_xh['value'] = (int)$this->_xh['ac'];
445 $this->_xh['lv'] = 3; // indicate we've found a value
448 $this->_xh['valuestack'][count($this->_xh['valuestack']) - 1]['name'] = $this->_xh['ac'];
451 // add to array in the stack the last element built,
452 // unless no VALUE was found
453 if ($this->_xh['vt']) {
454 $vscount = count($this->_xh['valuestack']);
455 $this->_xh['valuestack'][$vscount - 1]['values'][$this->_xh['valuestack'][$vscount - 1]['name']] = $this->_xh['value'];
457 error_log('XML-RPC: ' . __METHOD__ . ': missing VALUE inside STRUCT in received xml');
461 $this->_xh['vt'] = null; // reset this to check for 2 data elements in a row - even if they're empty
465 // fetch out of stack array of values, and promote it to current value
466 $currVal = array_pop($this->_xh['valuestack']);
467 $this->_xh['value'] = $currVal['values'];
468 $this->_xh['vt'] = strtolower($name);
469 if (isset($currVal['php_class'])) {
470 $this->_xh['php_class'] = $currVal['php_class'];
474 // add to array of params the current value,
475 // unless no VALUE was found
476 if ($this->_xh['vt']) {
477 $this->_xh['params'][] = $this->_xh['value'];
478 $this->_xh['pt'][] = $this->_xh['vt'];
480 error_log('XML-RPC: ' . __METHOD__ . ': missing VALUE inside PARAM in received xml');
484 $this->_xh['method'] = preg_replace('/^[\n\r\t ]+/', '', $this->_xh['ac']);
488 if (PhpXmlRpc::$xmlrpc_null_extension) {
489 $this->_xh['vt'] = 'null';
490 $this->_xh['value'] = null;
491 $this->_xh['lv'] = 3;
494 // drop through intentionally if nil extension not enabled
498 case 'METHORESPONSE':
501 // End of INVALID ELEMENT!
502 // shall we add an assert here for unreachable code???
509 * Used in decoding xmlrpc requests/responses without rebuilding xmlrpc Values.
510 * @param resource $parser
511 * @param string $name
513 public function xmlrpc_ee_fast($parser, $name)
515 $this->xmlrpc_ee($parser, $name, false);
519 * xml parser handler function for character data.
520 * @param resource $parser
521 * @param string $data
523 public function xmlrpc_cd($parser, $data)
525 // skip processing if xml fault already detected
526 if ($this->_xh['isf'] < 2) {
527 // "lookforvalue==3" means that we've found an entire value
528 // and should discard any further character data
529 if ($this->_xh['lv'] != 3) {
530 $this->_xh['ac'] .= $data;
536 * xml parser handler function for 'other stuff', ie. not char data or
537 * element start/end tag. In fact it only gets called on unknown entities...
541 public function xmlrpc_dh($parser, $data)
543 // skip processing if xml fault already detected
544 if ($this->_xh['isf'] < 2) {
545 if (substr($data, 0, 1) == '&' && substr($data, -1, 1) == ';') {
546 $this->_xh['ac'] .= $data;
554 * xml charset encoding guessing helper function.
555 * Tries to determine the charset encoding of an XML chunk received over HTTP.
556 * NB: according to the spec (RFC 3023), if text/xml content-type is received over HTTP without a content-type,
557 * we SHOULD assume it is strictly US-ASCII. But we try to be more tolerant of non conforming (legacy?) clients/servers,
558 * which will be most probably using UTF-8 anyway...
559 * In order of importance checks:
563 * 4. guesses using mb_detect_encoding()
565 * @param string $httpHeader the http Content-type header
566 * @param string $xmlChunk xml content buffer
567 * @param string $encodingPrefs comma separated list of character encodings to be used as default (when mb extension is enabled).
568 * This can also be set globally using PhpXmlRpc::$xmlrpc_detectencodings
569 * @return string the encoding determined. Null if it can't be determined and mbstring is enabled,
570 * PhpXmlRpc::$xmlrpc_defencoding if it can't be determined and mbstring is not enabled
572 * @todo explore usage of mb_http_input(): does it detect http headers + post data? if so, use it instead of hand-detection!!!
574 public static function guessEncoding($httpHeader = '', $xmlChunk = '', $encodingPrefs = null)
576 // discussion: see http://www.yale.edu/pclt/encoding/
577 // 1 - test if encoding is specified in HTTP HEADERS
580 // LWS: (\13\10)?( |\t)+
581 // token: (any char but excluded stuff)+
582 // quoted string: " (any char but double quotes and control chars)* "
583 // header: Content-type = ...; charset=value(; ...)*
584 // where value is of type token, no LWS allowed between 'charset' and value
585 // Note: we do not check for invalid chars in VALUE:
586 // this had better be done using pure ereg as below
587 // Note 2: we might be removing whitespace/tabs that ought to be left in if
588 // the received charset is a quoted string. But nobody uses such charset names...
590 /// @todo this test will pass if ANY header has charset specification, not only Content-Type. Fix it?
592 if (preg_match('/;\s*charset\s*=([^;]+)/i', $httpHeader, $matches)) {
593 return strtoupper(trim($matches[1], " \t\""));
596 // 2 - scan the first bytes of the data for a UTF-16 (or other) BOM pattern
597 // (source: http://www.w3.org/TR/2000/REC-xml-20001006)
598 // NOTE: actually, according to the spec, even if we find the BOM and determine
599 // an encoding, we should check if there is an encoding specified
600 // in the xml declaration, and verify if they match.
601 /// @todo implement check as described above?
602 /// @todo implement check for first bytes of string even without a BOM? (It sure looks harder than for cases WITH a BOM)
603 if (preg_match('/^(\x00\x00\xFE\xFF|\xFF\xFE\x00\x00|\x00\x00\xFF\xFE|\xFE\xFF\x00\x00)/', $xmlChunk)) {
605 } elseif (preg_match('/^(\xFE\xFF|\xFF\xFE)/', $xmlChunk)) {
607 } elseif (preg_match('/^(\xEF\xBB\xBF)/', $xmlChunk)) {
611 // 3 - test if encoding is specified in the xml declaration
613 // SPACE: (#x20 | #x9 | #xD | #xA)+ === [ \x9\xD\xA]+
614 // EQ: SPACE?=SPACE? === [ \x9\xD\xA]*=[ \x9\xD\xA]*
615 if (preg_match('/^<\?xml\s+version\s*=\s*' . "((?:\"[a-zA-Z0-9_.:-]+\")|(?:'[a-zA-Z0-9_.:-]+'))" .
616 '\s+encoding\s*=\s*' . "((?:\"[A-Za-z][A-Za-z0-9._-]*\")|(?:'[A-Za-z][A-Za-z0-9._-]*'))/",
617 $xmlChunk, $matches)) {
618 return strtoupper(substr($matches[2], 1, -1));
621 // 4 - if mbstring is available, let it do the guesswork
622 if (extension_loaded('mbstring')) {
623 if ($encodingPrefs == null && PhpXmlRpc::$xmlrpc_detectencodings != null) {
624 $encodingPrefs = PhpXmlRpc::$xmlrpc_detectencodings;
626 if ($encodingPrefs) {
627 $enc = mb_detect_encoding($xmlChunk, $encodingPrefs);
629 $enc = mb_detect_encoding($xmlChunk);
631 // NB: mb_detect likes to call it ascii, xml parser likes to call it US_ASCII...
632 // IANA also likes better US-ASCII, so go with it
633 if ($enc == 'ASCII') {
639 // no encoding specified: as per HTTP1.1 assume it is iso-8859-1?
640 // Both RFC 2616 (HTTP 1.1) and 1945 (HTTP 1.0) clearly state that for text/xxx content types
641 // this should be the standard. And we should be getting text/xml as request and response.
642 // BUT we have to be backward compatible with the lib, which always used UTF-8 as default...
643 return PhpXmlRpc::$xmlrpc_defencoding;
648 * Helper function: checks if an xml chunk as a charset declaration (BOM or in the xml declaration)
650 * @param string $xmlChunk
653 public static function hasEncoding($xmlChunk)
655 // scan the first bytes of the data for a UTF-16 (or other) BOM pattern
656 // (source: http://www.w3.org/TR/2000/REC-xml-20001006)
657 if (preg_match('/^(\x00\x00\xFE\xFF|\xFF\xFE\x00\x00|\x00\x00\xFF\xFE|\xFE\xFF\x00\x00)/', $xmlChunk)) {
659 } elseif (preg_match('/^(\xFE\xFF|\xFF\xFE)/', $xmlChunk)) {
661 } elseif (preg_match('/^(\xEF\xBB\xBF)/', $xmlChunk)) {
665 // test if encoding is specified in the xml declaration
667 // SPACE: (#x20 | #x9 | #xD | #xA)+ === [ \x9\xD\xA]+
668 // EQ: SPACE?=SPACE? === [ \x9\xD\xA]*=[ \x9\xD\xA]*
669 if (preg_match('/^<\?xml\s+version\s*=\s*' . "((?:\"[a-zA-Z0-9_.:-]+\")|(?:'[a-zA-Z0-9_.:-]+'))" .
670 '\s+encoding\s*=\s*' . "((?:\"[A-Za-z][A-Za-z0-9._-]*\")|(?:'[A-Za-z][A-Za-z0-9._-]*'))/",
671 $xmlChunk, $matches)) {