3 namespace PhpXmlRpc\Helper;
5 use PhpXmlRpc\PhpXmlRpc;
9 * Deals with parsing the XML.
13 // used to store state during parsing
14 // quick explanation of components:
15 // ac - used to accumulate values
16 // stack - array with genealogy of xml elements names:
17 // used to validate nesting of xmlrpc elements
18 // valuestack - array used for parsing arrays and structs
19 // lv - used to indicate "looking for a value": implements
20 // the logic to allow values with no types to be strings
21 // isf - used to indicate a parsing fault (2) or xmlrpc response fault (1)
22 // isf_reason - used for storing xmlrpc response fault string
23 // method - used to store method name
24 // params - used to store parameters in method calls
25 // pt - used to store the type of each received parameter. Useful if parameters are automatically decoded to php values
26 // rt - 'methodcall or 'methodresponse'
30 'valuestack' => array(),
33 'method' => false, // so we can check later if we got a methodname or not
39 public $xmlrpc_valid_parents = array(
40 'VALUE' => array('MEMBER', 'DATA', 'PARAM', 'FAULT'),
41 'BOOLEAN' => array('VALUE'),
42 'I4' => array('VALUE'),
43 'I8' => array('VALUE'),
44 'EX:I8' => array('VALUE'),
45 'INT' => array('VALUE'),
46 'STRING' => array('VALUE'),
47 'DOUBLE' => array('VALUE'),
48 'DATETIME.ISO8601' => array('VALUE'),
49 'BASE64' => array('VALUE'),
50 'MEMBER' => array('STRUCT'),
51 'NAME' => array('MEMBER'),
52 'DATA' => array('ARRAY'),
53 'ARRAY' => array('VALUE'),
54 'STRUCT' => array('VALUE'),
55 'PARAM' => array('PARAMS'),
56 'METHODNAME' => array('METHODCALL'),
57 'PARAMS' => array('METHODCALL', 'METHODRESPONSE'),
58 'FAULT' => array('METHODRESPONSE'),
59 'NIL' => array('VALUE'), // only used when extension activated
60 'EX:NIL' => array('VALUE'), // only used when extension activated
64 * xml parser handler function for opening element tags.
66 public function xmlrpc_se($parser, $name, $attrs, $acceptSingleVals = false)
68 // if invalid xmlrpc already detected, skip all processing
69 if ($this->_xh['isf'] < 2) {
70 // check for correct element nesting
71 // top level element can only be of 2 types
72 /// @todo optimization creep: save this check into a bool variable, instead of using count() every time:
73 /// there is only a single top level element in xml anyway
74 if (count($this->_xh['stack']) == 0) {
75 if ($name != 'METHODRESPONSE' && $name != 'METHODCALL' && (
76 $name != 'VALUE' && !$acceptSingleVals)
78 $this->_xh['isf'] = 2;
79 $this->_xh['isf_reason'] = 'missing top level xmlrpc element';
83 $this->_xh['rt'] = strtolower($name);
86 // not top level element: see if parent is OK
87 $parent = end($this->_xh['stack']);
88 if (!array_key_exists($name, $this->xmlrpc_valid_parents) || !in_array($parent, $this->xmlrpc_valid_parents[$name])) {
89 $this->_xh['isf'] = 2;
90 $this->_xh['isf_reason'] = "xmlrpc element $name cannot be child of $parent";
97 // optimize for speed switch cases: most common cases first
99 /// @todo we could check for 2 VALUE elements inside a MEMBER or PARAM element
100 $this->_xh['vt'] = 'value'; // indicator: no value found yet
101 $this->_xh['ac'] = '';
102 $this->_xh['lv'] = 1;
103 $this->_xh['php_class'] = null;
107 if (PHP_INT_SIZE === 4) {
108 /// INVALID ELEMENT: RAISE ISF so that it is later recognized!!!
109 $this->_xh['isf'] = 2;
110 $this->_xh['isf_reason'] = "Received i8 element but php is compiled in 32 bit mode";
114 // fall through voluntarily
120 case 'DATETIME.ISO8601':
122 if ($this->_xh['vt'] != 'value') {
123 // two data elements inside a value: an error occurred!
124 $this->_xh['isf'] = 2;
125 $this->_xh['isf_reason'] = "$name element following a {$this->_xh['vt']} element inside a single value";
129 $this->_xh['ac'] = ''; // reset the accumulator
133 if ($this->_xh['vt'] != 'value') {
134 //two data elements inside a value: an error occurred!
135 $this->_xh['isf'] = 2;
136 $this->_xh['isf_reason'] = "$name element following a {$this->_xh['vt']} element inside a single value";
140 // create an empty array to hold child values, and push it onto appropriate stack
142 $curVal['values'] = array();
143 $curVal['type'] = $name;
144 // check for out-of-band information to rebuild php objs
145 // and in case it is found, save it
146 if (@isset($attrs['PHP_CLASS'])) {
147 $curVal['php_class'] = $attrs['PHP_CLASS'];
149 $this->_xh['valuestack'][] = $curVal;
150 $this->_xh['vt'] = 'data'; // be prepared for a data element next
153 if ($this->_xh['vt'] != 'data') {
154 //two data elements inside a value: an error occurred!
155 $this->_xh['isf'] = 2;
156 $this->_xh['isf_reason'] = "found two data elements inside an array element";
161 case 'METHODRESPONSE':
163 // valid elements that add little to processing
167 /// @todo we could check for 2 NAME elements inside a MEMBER element
168 $this->_xh['ac'] = '';
171 $this->_xh['isf'] = 1;
174 $this->_xh['valuestack'][count($this->_xh['valuestack']) - 1]['name'] = ''; // set member name to null, in case we do not find in the xml later on
175 //$this->_xh['ac']='';
176 // Drop trough intentionally
178 // clear value type, so we can check later if no value has been passed for this param/member
179 $this->_xh['vt'] = null;
183 if (PhpXmlRpc::$xmlrpc_null_extension) {
184 if ($this->_xh['vt'] != 'value') {
185 //two data elements inside a value: an error occurred!
186 $this->_xh['isf'] = 2;
187 $this->_xh['isf_reason'] = "$name element following a {$this->_xh['vt']} element inside a single value";
191 $this->_xh['ac'] = ''; // reset the accumulator
194 // we do not support the <NIL/> extension, so
195 // drop through intentionally
197 /// INVALID ELEMENT: RAISE ISF so that it is later recognized!!!
198 $this->_xh['isf'] = 2;
199 $this->_xh['isf_reason'] = "found not-xmlrpc xml element $name";
203 // Save current element name to stack, to validate nesting
204 $this->_xh['stack'][] = $name;
206 /// @todo optimization creep: move this inside the big switch() above
207 if ($name != 'VALUE') {
208 $this->_xh['lv'] = 0;
214 * Used in decoding xml chunks that might represent single xmlrpc values.
216 public function xmlrpc_se_any($parser, $name, $attrs)
218 $this->xmlrpc_se($parser, $name, $attrs, true);
222 * xml parser handler function for close element tags.
224 public function xmlrpc_ee($parser, $name, $rebuildXmlrpcvals = true)
226 if ($this->_xh['isf'] < 2) {
227 // push this element name from stack
228 // NB: if XML validates, correct opening/closing is guaranteed and
229 // we do not have to check for $name == $currElem.
230 // we also checked for proper nesting at start of elements...
231 $currElem = array_pop($this->_xh['stack']);
235 // This if() detects if no scalar was inside <VALUE></VALUE>
236 if ($this->_xh['vt'] == 'value') {
237 $this->_xh['value'] = $this->_xh['ac'];
238 $this->_xh['vt'] = Value::$xmlrpcString;
241 if ($rebuildXmlrpcvals) {
242 // build the xmlrpc val out of the data received, and substitute it
243 $temp = new Value($this->_xh['value'], $this->_xh['vt']);
244 // in case we got info about underlying php class, save it
245 // in the object we're rebuilding
246 if (isset($this->_xh['php_class'])) {
247 $temp->_php_class = $this->_xh['php_class'];
249 // check if we are inside an array or struct:
250 // if value just built is inside an array, let's move it into array on the stack
251 $vscount = count($this->_xh['valuestack']);
252 if ($vscount && $this->_xh['valuestack'][$vscount - 1]['type'] == 'ARRAY') {
253 $this->_xh['valuestack'][$vscount - 1]['values'][] = $temp;
255 $this->_xh['value'] = $temp;
258 /// @todo this needs to treat correctly php-serialized objects,
259 /// since std deserializing is done by php_xmlrpc_decode,
260 /// which we will not be calling...
261 if (isset($this->_xh['php_class'])) {
264 // check if we are inside an array or struct:
265 // if value just built is inside an array, let's move it into array on the stack
266 $vscount = count($this->_xh['valuestack']);
267 if ($vscount && $this->_xh['valuestack'][$vscount - 1]['type'] == 'ARRAY') {
268 $this->_xh['valuestack'][$vscount - 1]['values'][] = $this->_xh['value'];
279 case 'DATETIME.ISO8601':
281 $this->_xh['vt'] = strtolower($name);
282 /// @todo: optimization creep - remove the if/elseif cycle below
283 /// since the case() in which we are already did that
284 if ($name == 'STRING') {
285 $this->_xh['value'] = $this->_xh['ac'];
286 } elseif ($name == 'DATETIME.ISO8601') {
287 if (!preg_match('/^[0-9]{8}T[0-9]{2}:[0-9]{2}:[0-9]{2}$/', $this->_xh['ac'])) {
288 error_log('XML-RPC: ' . __METHOD__ . ': invalid value received in DATETIME: ' . $this->_xh['ac']);
290 $this->_xh['vt'] = Value::$xmlrpcDateTime;
291 $this->_xh['value'] = $this->_xh['ac'];
292 } elseif ($name == 'BASE64') {
293 /// @todo check for failure of base64 decoding / catch warnings
294 $this->_xh['value'] = base64_decode($this->_xh['ac']);
295 } elseif ($name == 'BOOLEAN') {
296 // special case here: we translate boolean 1 or 0 into PHP
297 // constants true or false.
298 // Strings 'true' and 'false' are accepted, even though the
299 // spec never mentions them (see eg. Blogger api docs)
300 // NB: this simple checks helps a lot sanitizing input, ie no
301 // security problems around here
302 if ($this->_xh['ac'] == '1' || strcasecmp($this->_xh['ac'], 'true') == 0) {
303 $this->_xh['value'] = true;
305 // log if receiving something strange, even though we set the value to false anyway
306 if ($this->_xh['ac'] != '0' && strcasecmp($this->_xh['ac'], 'false') != 0) {
307 error_log('XML-RPC: ' . __METHOD__ . ': invalid value received in BOOLEAN: ' . $this->_xh['ac']);
309 $this->_xh['value'] = false;
311 } elseif ($name == 'DOUBLE') {
313 // we must check that only 0123456789-.<space> are characters here
314 // NOTE: regexp could be much stricter than this...
315 if (!preg_match('/^[+-eE0123456789 \t.]+$/', $this->_xh['ac'])) {
316 /// @todo: find a better way of throwing an error than this!
317 error_log('XML-RPC: ' . __METHOD__ . ': non numeric value received in DOUBLE: ' . $this->_xh['ac']);
318 $this->_xh['value'] = 'ERROR_NON_NUMERIC_FOUND';
320 // it's ok, add it on
321 $this->_xh['value'] = (double)$this->_xh['ac'];
324 // we have an I4/I8/INT
325 // we must check that only 0123456789-<space> are characters here
326 if (!preg_match('/^[+-]?[0123456789 \t]+$/', $this->_xh['ac'])) {
327 /// @todo find a better way of throwing an error than this!
328 error_log('XML-RPC: ' . __METHOD__ . ': non numeric value received in INT: ' . $this->_xh['ac']);
329 $this->_xh['value'] = 'ERROR_NON_NUMERIC_FOUND';
331 // it's ok, add it on
332 $this->_xh['value'] = (int)$this->_xh['ac'];
335 $this->_xh['lv'] = 3; // indicate we've found a value
338 $this->_xh['valuestack'][count($this->_xh['valuestack']) - 1]['name'] = $this->_xh['ac'];
341 // add to array in the stack the last element built,
342 // unless no VALUE was found
343 if ($this->_xh['vt']) {
344 $vscount = count($this->_xh['valuestack']);
345 $this->_xh['valuestack'][$vscount - 1]['values'][$this->_xh['valuestack'][$vscount - 1]['name']] = $this->_xh['value'];
347 error_log('XML-RPC: ' . __METHOD__ . ': missing VALUE inside STRUCT in received xml');
351 $this->_xh['vt'] = null; // reset this to check for 2 data elements in a row - even if they're empty
355 // fetch out of stack array of values, and promote it to current value
356 $currVal = array_pop($this->_xh['valuestack']);
357 $this->_xh['value'] = $currVal['values'];
358 $this->_xh['vt'] = strtolower($name);
359 if (isset($currVal['php_class'])) {
360 $this->_xh['php_class'] = $currVal['php_class'];
364 // add to array of params the current value,
365 // unless no VALUE was found
366 if ($this->_xh['vt']) {
367 $this->_xh['params'][] = $this->_xh['value'];
368 $this->_xh['pt'][] = $this->_xh['vt'];
370 error_log('XML-RPC: ' . __METHOD__ . ': missing VALUE inside PARAM in received xml');
374 $this->_xh['method'] = preg_replace('/^[\n\r\t ]+/', '', $this->_xh['ac']);
378 if (PhpXmlRpc::$xmlrpc_null_extension) {
379 $this->_xh['vt'] = 'null';
380 $this->_xh['value'] = null;
381 $this->_xh['lv'] = 3;
384 // drop through intentionally if nil extension not enabled
388 case 'METHORESPONSE':
391 // End of INVALID ELEMENT!
392 // shall we add an assert here for unreachable code???
399 * Used in decoding xmlrpc requests/responses without rebuilding xmlrpc Values.
401 public function xmlrpc_ee_fast($parser, $name)
403 $this->xmlrpc_ee($parser, $name, false);
407 * xml parser handler function for character data.
409 public function xmlrpc_cd($parser, $data)
411 // skip processing if xml fault already detected
412 if ($this->_xh['isf'] < 2) {
413 // "lookforvalue==3" means that we've found an entire value
414 // and should discard any further character data
415 if ($this->_xh['lv'] != 3) {
416 $this->_xh['ac'] .= $data;
422 * xml parser handler function for 'other stuff', ie. not char data or
423 * element start/end tag. In fact it only gets called on unknown entities...
425 public function xmlrpc_dh($parser, $data)
427 // skip processing if xml fault already detected
428 if ($this->_xh['isf'] < 2) {
429 if (substr($data, 0, 1) == '&' && substr($data, -1, 1) == ';') {
430 $this->_xh['ac'] .= $data;
438 * xml charset encoding guessing helper function.
439 * Tries to determine the charset encoding of an XML chunk received over HTTP.
440 * NB: according to the spec (RFC 3023), if text/xml content-type is received over HTTP without a content-type,
441 * we SHOULD assume it is strictly US-ASCII. But we try to be more tolerant of non conforming (legacy?) clients/servers,
442 * which will be most probably using UTF-8 anyway...
443 * In order of importance checks:
447 * 4. guesses using mb_detect_encoding()
449 * @param string $httpHeader the http Content-type header
450 * @param string $xmlChunk xml content buffer
451 * @param string $encodingPrefs comma separated list of character encodings to be used as default (when mb extension is enabled).
452 * This can also be set globally using PhpXmlRpc::$xmlrpc_detectencodings
453 * @return string the encoding determined. Null if it can't be determined and mbstring is enabled,
454 * PhpXmlRpc::$xmlrpc_defencoding if it can't be determined and mbstring is not enabled
456 * @todo explore usage of mb_http_input(): does it detect http headers + post data? if so, use it instead of hand-detection!!!
458 public static function guessEncoding($httpHeader = '', $xmlChunk = '', $encodingPrefs = null)
460 // discussion: see http://www.yale.edu/pclt/encoding/
461 // 1 - test if encoding is specified in HTTP HEADERS
464 // LWS: (\13\10)?( |\t)+
465 // token: (any char but excluded stuff)+
466 // quoted string: " (any char but double quotes and control chars)* "
467 // header: Content-type = ...; charset=value(; ...)*
468 // where value is of type token, no LWS allowed between 'charset' and value
469 // Note: we do not check for invalid chars in VALUE:
470 // this had better be done using pure ereg as below
471 // Note 2: we might be removing whitespace/tabs that ought to be left in if
472 // the received charset is a quoted string. But nobody uses such charset names...
474 /// @todo this test will pass if ANY header has charset specification, not only Content-Type. Fix it?
476 if (preg_match('/;\s*charset\s*=([^;]+)/i', $httpHeader, $matches)) {
477 return strtoupper(trim($matches[1], " \t\""));
480 // 2 - scan the first bytes of the data for a UTF-16 (or other) BOM pattern
481 // (source: http://www.w3.org/TR/2000/REC-xml-20001006)
482 // NOTE: actually, according to the spec, even if we find the BOM and determine
483 // an encoding, we should check if there is an encoding specified
484 // in the xml declaration, and verify if they match.
485 /// @todo implement check as described above?
486 /// @todo implement check for first bytes of string even without a BOM? (It sure looks harder than for cases WITH a BOM)
487 if (preg_match('/^(\x00\x00\xFE\xFF|\xFF\xFE\x00\x00|\x00\x00\xFF\xFE|\xFE\xFF\x00\x00)/', $xmlChunk)) {
489 } elseif (preg_match('/^(\xFE\xFF|\xFF\xFE)/', $xmlChunk)) {
491 } elseif (preg_match('/^(\xEF\xBB\xBF)/', $xmlChunk)) {
495 // 3 - test if encoding is specified in the xml declaration
497 // SPACE: (#x20 | #x9 | #xD | #xA)+ === [ \x9\xD\xA]+
498 // EQ: SPACE?=SPACE? === [ \x9\xD\xA]*=[ \x9\xD\xA]*
499 if (preg_match('/^<\?xml\s+version\s*=\s*' . "((?:\"[a-zA-Z0-9_.:-]+\")|(?:'[a-zA-Z0-9_.:-]+'))" .
500 '\s+encoding\s*=\s*' . "((?:\"[A-Za-z][A-Za-z0-9._-]*\")|(?:'[A-Za-z][A-Za-z0-9._-]*'))/",
501 $xmlChunk, $matches)) {
502 return strtoupper(substr($matches[2], 1, -1));
505 // 4 - if mbstring is available, let it do the guesswork
506 if (extension_loaded('mbstring')) {
507 if ($encodingPrefs == null && PhpXmlRpc::$xmlrpc_detectencodings != null) {
508 $encodingPrefs = PhpXmlRpc::$xmlrpc_detectencodings;
510 if ($encodingPrefs) {
511 $enc = mb_detect_encoding($xmlChunk, $encodingPrefs);
513 $enc = mb_detect_encoding($xmlChunk);
515 // NB: mb_detect likes to call it ascii, xml parser likes to call it US_ASCII...
516 // IANA also likes better US-ASCII, so go with it
517 if ($enc == 'ASCII') {
523 // no encoding specified: as per HTTP1.1 assume it is iso-8859-1?
524 // Both RFC 2616 (HTTP 1.1) and 1945 (HTTP 1.0) clearly state that for text/xxx content types
525 // this should be the standard. And we should be getting text/xml as request and response.
526 // BUT we have to be backward compatible with the lib, which always used UTF-8 as default...
527 return PhpXmlRpc::$xmlrpc_defencoding;
532 * Helper function: checks if an xml chunk as a charset declaration (BOM or in the xml declaration)
534 * @param string $xmlChunk
537 public static function hasEncoding($xmlChunk)
539 // scan the first bytes of the data for a UTF-16 (or other) BOM pattern
540 // (source: http://www.w3.org/TR/2000/REC-xml-20001006)
541 if (preg_match('/^(\x00\x00\xFE\xFF|\xFF\xFE\x00\x00|\x00\x00\xFF\xFE|\xFE\xFF\x00\x00)/', $xmlChunk)) {
543 } elseif (preg_match('/^(\xFE\xFF|\xFF\xFE)/', $xmlChunk)) {
545 } elseif (preg_match('/^(\xEF\xBB\xBF)/', $xmlChunk)) {
549 // test if encoding is specified in the xml declaration
551 // SPACE: (#x20 | #x9 | #xD | #xA)+ === [ \x9\xD\xA]+
552 // EQ: SPACE?=SPACE? === [ \x9\xD\xA]*=[ \x9\xD\xA]*
553 if (preg_match('/^<\?xml\s+version\s*=\s*' . "((?:\"[a-zA-Z0-9_.:-]+\")|(?:'[a-zA-Z0-9_.:-]+'))" .
554 '\s+encoding\s*=\s*' . "((?:\"[A-Za-z][A-Za-z0-9._-]*\")|(?:'[A-Za-z][A-Za-z0-9._-]*'))/",
555 $xmlChunk, $matches)) {