3 namespace PhpXmlRpc\Helper;
5 use PhpXmlRpc\PhpXmlRpc;
9 * Deals with parsing the XML.
13 const RETURN_XMLRPCVALS = 'xmlrpcvals';
14 const RETURN_PHP = 'phpvals';
16 const ACCEPT_REQUEST = 1;
17 const ACCEPT_RESPONSE = 2;
18 const ACCEPT_VALUE = 4;
19 const ACCEPT_FAULT = 8;
21 // Used to store state during parsing.
22 // Quick explanation of components:
24 // ac - used to accumulate values
25 // stack - array with genealogy of xml elements names used to validate nesting of xmlrpc elements
26 // valuestack - array used for parsing arrays and structs
27 // lv - used to indicate "looking for a value": implements the logic to allow values with no types to be strings
29 // isf - used to indicate an xml parsing fault (3), invalid xmlrpc fault (2) or xmlrpc response fault (1)
30 // isf_reason - used for storing xmlrpc response fault string
31 // method - used to store method name
32 // params - used to store parameters in method calls
33 // pt - used to store the type of each received parameter. Useful if parameters are automatically decoded to php values
34 // rt - 'methodcall', 'methodresponse', 'value' or 'fault' (the last one used only in EPI emulation mode)
38 'valuestack' => array(),
47 public $xmlrpc_valid_parents = array(
48 'VALUE' => array('MEMBER', 'DATA', 'PARAM', 'FAULT'),
49 'BOOLEAN' => array('VALUE'),
50 'I4' => array('VALUE'),
51 'I8' => array('VALUE'),
52 'EX:I8' => array('VALUE'),
53 'INT' => array('VALUE'),
54 'STRING' => array('VALUE'),
55 'DOUBLE' => array('VALUE'),
56 'DATETIME.ISO8601' => array('VALUE'),
57 'BASE64' => array('VALUE'),
58 'MEMBER' => array('STRUCT'),
59 'NAME' => array('MEMBER'),
60 'DATA' => array('ARRAY'),
61 'ARRAY' => array('VALUE'),
62 'STRUCT' => array('VALUE'),
63 'PARAM' => array('PARAMS'),
64 'METHODNAME' => array('METHODCALL'),
65 'PARAMS' => array('METHODCALL', 'METHODRESPONSE'),
66 'FAULT' => array('METHODRESPONSE'),
67 'NIL' => array('VALUE'), // only used when extension activated
68 'EX:NIL' => array('VALUE'), // only used when extension activated
71 /** @var array $parsing_options */
72 protected $parsing_options = array();
73 /** @var int $accept self::ACCEPT_REQUEST | self::ACCEPT_RESPONSE by default */
74 protected $accept = 3;
75 /** @var int $maxChunkLength 4 MB by default. Any value below 10MB should be good */
76 protected $maxChunkLength = 4194304;
79 * @param array $options passed to the xml parser
81 public function __construct(array $options = array())
83 $this->parsing_options = $options;
88 * @param string $returnType
89 * @param int $accept a bit-combination of self::ACCEPT_REQUEST, self::ACCEPT_RESPONSE, self::ACCEPT_VALUE
92 public function parse($data, $returnType = self::RETURN_XMLRPCVALS, $accept = 3)
97 'valuestack' => array(),
100 'method' => false, // so we can check later if we got a methodname or not
106 $len = strlen($data);
108 // we test for empty documents here to save on resource allocation and simply the chunked-parsing loop below
110 $this->_xh['isf'] = 3;
111 $this->_xh['isf_reason'] = 'XML error 5: empty document';
115 $parser = xml_parser_create();
117 foreach ($this->parsing_options as $key => $val) {
118 xml_parser_set_option($parser, $key, $val);
120 // always set this, in case someone tries to disable it via options...
121 xml_parser_set_option($parser, XML_OPTION_CASE_FOLDING, 1);
123 xml_set_object($parser, $this);
125 if ($returnType == self::RETURN_PHP) {
126 xml_set_element_handler($parser, 'xmlrpc_se', 'xmlrpc_ee_fast');
128 xml_set_element_handler($parser, 'xmlrpc_se', 'xmlrpc_ee');
131 xml_set_character_data_handler($parser, 'xmlrpc_cd');
132 xml_set_default_handler($parser, 'xmlrpc_dh');
134 $this->accept = $accept;
136 // @see ticket #70 - we have to parse big xml docks in chunks to avoid errors
137 for ($offset = 0; $offset < $len; $offset += $this->maxChunkLength) {
138 $chunk = substr($data, $offset, $this->maxChunkLength);
139 // error handling: xml not well formed
140 if (!xml_parse($parser, $chunk, $offset + $this->maxChunkLength >= $len)) {
141 $errCode = xml_get_error_code($parser);
142 $errStr = sprintf('XML error %s: %s at line %d, column %d', $errCode, xml_error_string($errCode),
143 xml_get_current_line_number($parser), xml_get_current_column_number($parser));
145 $this->_xh['isf'] = 3;
146 $this->_xh['isf_reason'] = $errStr;
151 xml_parser_free($parser);
155 * xml parser handler function for opening element tags.
156 * @param resource $parser
157 * @param string $name
159 * @param bool $acceptSingleVals DEPRECATED use the $accept parameter instead
161 public function xmlrpc_se($parser, $name, $attrs, $acceptSingleVals = false)
163 // if invalid xmlrpc already detected, skip all processing
164 if ($this->_xh['isf'] < 2) {
166 // check for correct element nesting
167 if (count($this->_xh['stack']) == 0) {
168 // top level element can only be of 2 types
169 /// @todo optimization creep: save this check into a bool variable, instead of using count() every time:
170 /// there is only a single top level element in xml anyway
172 if ($acceptSingleVals === false) {
173 $accept = $this->accept;
175 $accept = self::ACCEPT_REQUEST | self::ACCEPT_RESPONSE | self::ACCEPT_VALUE;
177 if (($name == 'METHODCALL' && ($accept & self::ACCEPT_REQUEST)) ||
178 ($name == 'METHODRESPONSE' && ($accept & self::ACCEPT_RESPONSE)) ||
179 ($name == 'VALUE' && ($accept & self::ACCEPT_VALUE)) ||
180 ($name == 'FAULT' && ($accept & self::ACCEPT_FAULT))) {
181 $this->_xh['rt'] = strtolower($name);
183 $this->_xh['isf'] = 2;
184 $this->_xh['isf_reason'] = 'missing top level xmlrpc element. Found: ' . $name;
189 // not top level element: see if parent is OK
190 $parent = end($this->_xh['stack']);
191 if (!array_key_exists($name, $this->xmlrpc_valid_parents) || !in_array($parent, $this->xmlrpc_valid_parents[$name])) {
192 $this->_xh['isf'] = 2;
193 $this->_xh['isf_reason'] = "xmlrpc element $name cannot be child of $parent";
200 // optimize for speed switch cases: most common cases first
202 /// @todo we could check for 2 VALUE elements inside a MEMBER or PARAM element
203 $this->_xh['vt'] = 'value'; // indicator: no value found yet
204 $this->_xh['ac'] = '';
205 $this->_xh['lv'] = 1;
206 $this->_xh['php_class'] = null;
210 if (PHP_INT_SIZE === 4) {
211 // INVALID ELEMENT: RAISE ISF so that it is later recognized!!!
212 $this->_xh['isf'] = 2;
213 $this->_xh['isf_reason'] = "Received i8 element but php is compiled in 32 bit mode";
217 // fall through voluntarily
223 case 'DATETIME.ISO8601':
225 if ($this->_xh['vt'] != 'value') {
226 // two data elements inside a value: an error occurred!
227 $this->_xh['isf'] = 2;
228 $this->_xh['isf_reason'] = "$name element following a {$this->_xh['vt']} element inside a single value";
232 $this->_xh['ac'] = ''; // reset the accumulator
236 if ($this->_xh['vt'] != 'value') {
237 // two data elements inside a value: an error occurred!
238 $this->_xh['isf'] = 2;
239 $this->_xh['isf_reason'] = "$name element following a {$this->_xh['vt']} element inside a single value";
243 // create an empty array to hold child values, and push it onto appropriate stack
245 $curVal['values'] = array();
246 $curVal['type'] = $name;
247 // check for out-of-band information to rebuild php objs
248 // and in case it is found, save it
249 if (@isset($attrs['PHP_CLASS'])) {
250 $curVal['php_class'] = $attrs['PHP_CLASS'];
252 $this->_xh['valuestack'][] = $curVal;
253 $this->_xh['vt'] = 'data'; // be prepared for a data element next
256 if ($this->_xh['vt'] != 'data') {
257 // two data elements inside a value: an error occurred!
258 $this->_xh['isf'] = 2;
259 $this->_xh['isf_reason'] = "found two data elements inside an array element";
264 case 'METHODRESPONSE':
266 // valid elements that add little to processing
270 /// @todo we could check for 2 NAME elements inside a MEMBER element
271 $this->_xh['ac'] = '';
274 $this->_xh['isf'] = 1;
277 // set member name to null, in case we do not find in the xml later on
278 $this->_xh['valuestack'][count($this->_xh['valuestack']) - 1]['name'] = '';
279 //$this->_xh['ac']='';
280 // Drop trough intentionally
282 // clear value type, so we can check later if no value has been passed for this param/member
283 $this->_xh['vt'] = null;
287 if (PhpXmlRpc::$xmlrpc_null_extension) {
288 if ($this->_xh['vt'] != 'value') {
289 // two data elements inside a value: an error occurred!
290 $this->_xh['isf'] = 2;
291 $this->_xh['isf_reason'] = "$name element following a {$this->_xh['vt']} element inside a single value";
295 $this->_xh['ac'] = ''; // reset the accumulator
298 // we do not support the <NIL/> extension, so
299 // drop through intentionally
301 // INVALID ELEMENT: RAISE ISF so that it is later recognized!!!
302 $this->_xh['isf'] = 2;
303 $this->_xh['isf_reason'] = "found not-xmlrpc xml element $name";
307 // Save current element name to stack, to validate nesting
308 $this->_xh['stack'][] = $name;
310 /// @todo optimization creep: move this inside the big switch() above
311 if ($name != 'VALUE') {
312 $this->_xh['lv'] = 0;
318 * xml parser handler function for opening element tags.
319 * Used in decoding xml chunks that might represent single xmlrpc values as well as requests, responses.
321 * @param resource $parser
325 public function xmlrpc_se_any($parser, $name, $attrs)
327 $this->xmlrpc_se($parser, $name, $attrs, true);
331 * xml parser handler function for close element tags.
332 * @param resource $parser
333 * @param string $name
334 * @param bool $rebuildXmlrpcvals
336 public function xmlrpc_ee($parser, $name, $rebuildXmlrpcvals = true)
338 if ($this->_xh['isf'] < 2) {
339 // push this element name from stack
340 // NB: if XML validates, correct opening/closing is guaranteed and
341 // we do not have to check for $name == $currElem.
342 // we also checked for proper nesting at start of elements...
343 $currElem = array_pop($this->_xh['stack']);
347 // This if() detects if no scalar was inside <VALUE></VALUE>
348 if ($this->_xh['vt'] == 'value') {
349 $this->_xh['value'] = $this->_xh['ac'];
350 $this->_xh['vt'] = Value::$xmlrpcString;
353 if ($rebuildXmlrpcvals) {
354 // build the xmlrpc val out of the data received, and substitute it
355 $temp = new Value($this->_xh['value'], $this->_xh['vt']);
356 // in case we got info about underlying php class, save it
357 // in the object we're rebuilding
358 if (isset($this->_xh['php_class'])) {
359 $temp->_php_class = $this->_xh['php_class'];
361 // check if we are inside an array or struct:
362 // if value just built is inside an array, let's move it into array on the stack
363 $vscount = count($this->_xh['valuestack']);
364 if ($vscount && $this->_xh['valuestack'][$vscount - 1]['type'] == 'ARRAY') {
365 $this->_xh['valuestack'][$vscount - 1]['values'][] = $temp;
367 $this->_xh['value'] = $temp;
370 /// @todo this needs to treat correctly php-serialized objects,
371 /// since std deserializing is done by php_xmlrpc_decode,
372 /// which we will not be calling...
373 if (isset($this->_xh['php_class'])) {
376 // check if we are inside an array or struct:
377 // if value just built is inside an array, let's move it into array on the stack
378 $vscount = count($this->_xh['valuestack']);
379 if ($vscount && $this->_xh['valuestack'][$vscount - 1]['type'] == 'ARRAY') {
380 $this->_xh['valuestack'][$vscount - 1]['values'][] = $this->_xh['value'];
391 case 'DATETIME.ISO8601':
393 $this->_xh['vt'] = strtolower($name);
394 /// @todo: optimization creep - remove the if/elseif cycle below
395 /// since the case() in which we are already did that
396 if ($name == 'STRING') {
397 $this->_xh['value'] = $this->_xh['ac'];
398 } elseif ($name == 'DATETIME.ISO8601') {
399 if (!preg_match('/^[0-9]{8}T[0-9]{2}:[0-9]{2}:[0-9]{2}$/', $this->_xh['ac'])) {
400 Logger::instance()->errorLog('XML-RPC: ' . __METHOD__ . ': invalid value received in DATETIME: ' . $this->_xh['ac']);
402 $this->_xh['vt'] = Value::$xmlrpcDateTime;
403 $this->_xh['value'] = $this->_xh['ac'];
404 } elseif ($name == 'BASE64') {
405 /// @todo check for failure of base64 decoding / catch warnings
406 $this->_xh['value'] = base64_decode($this->_xh['ac']);
407 } elseif ($name == 'BOOLEAN') {
408 // special case here: we translate boolean 1 or 0 into PHP
409 // constants true or false.
410 // Strings 'true' and 'false' are accepted, even though the
411 // spec never mentions them (see eg. Blogger api docs)
412 // NB: this simple checks helps a lot sanitizing input, ie no
413 // security problems around here
414 if ($this->_xh['ac'] == '1' || strcasecmp($this->_xh['ac'], 'true') == 0) {
415 $this->_xh['value'] = true;
417 // log if receiving something strange, even though we set the value to false anyway
418 if ($this->_xh['ac'] != '0' && strcasecmp($this->_xh['ac'], 'false') != 0) {
419 Logger::instance()->errorLog('XML-RPC: ' . __METHOD__ . ': invalid value received in BOOLEAN: ' . $this->_xh['ac']);
421 $this->_xh['value'] = false;
423 } elseif ($name == 'DOUBLE') {
425 // we must check that only 0123456789-.<space> are characters here
426 // NOTE: regexp could be much stricter than this...
427 if (!preg_match('/^[+-eE0123456789 \t.]+$/', $this->_xh['ac'])) {
428 /// @todo: find a better way of throwing an error than this!
429 Logger::instance()->errorLog('XML-RPC: ' . __METHOD__ . ': non numeric value received in DOUBLE: ' . $this->_xh['ac']);
430 $this->_xh['value'] = 'ERROR_NON_NUMERIC_FOUND';
432 // it's ok, add it on
433 $this->_xh['value'] = (double)$this->_xh['ac'];
436 // we have an I4/I8/INT
437 // we must check that only 0123456789-<space> are characters here
438 if (!preg_match('/^[+-]?[0123456789 \t]+$/', $this->_xh['ac'])) {
439 /// @todo find a better way of throwing an error than this!
440 Logger::instance()->errorLog('XML-RPC: ' . __METHOD__ . ': non numeric value received in INT: ' . $this->_xh['ac']);
441 $this->_xh['value'] = 'ERROR_NON_NUMERIC_FOUND';
443 // it's ok, add it on
444 $this->_xh['value'] = (int)$this->_xh['ac'];
447 $this->_xh['lv'] = 3; // indicate we've found a value
450 $this->_xh['valuestack'][count($this->_xh['valuestack']) - 1]['name'] = $this->_xh['ac'];
453 // add to array in the stack the last element built,
454 // unless no VALUE was found
455 if ($this->_xh['vt']) {
456 $vscount = count($this->_xh['valuestack']);
457 $this->_xh['valuestack'][$vscount - 1]['values'][$this->_xh['valuestack'][$vscount - 1]['name']] = $this->_xh['value'];
459 Logger::instance()->errorLog('XML-RPC: ' . __METHOD__ . ': missing VALUE inside STRUCT in received xml');
463 $this->_xh['vt'] = null; // reset this to check for 2 data elements in a row - even if they're empty
467 // fetch out of stack array of values, and promote it to current value
468 $currVal = array_pop($this->_xh['valuestack']);
469 $this->_xh['value'] = $currVal['values'];
470 $this->_xh['vt'] = strtolower($name);
471 if (isset($currVal['php_class'])) {
472 $this->_xh['php_class'] = $currVal['php_class'];
476 // add to array of params the current value,
477 // unless no VALUE was found
478 if ($this->_xh['vt']) {
479 $this->_xh['params'][] = $this->_xh['value'];
480 $this->_xh['pt'][] = $this->_xh['vt'];
482 Logger::instance()->errorLog('XML-RPC: ' . __METHOD__ . ': missing VALUE inside PARAM in received xml');
486 $this->_xh['method'] = preg_replace('/^[\n\r\t ]+/', '', $this->_xh['ac']);
490 if (PhpXmlRpc::$xmlrpc_null_extension) {
491 $this->_xh['vt'] = 'null';
492 $this->_xh['value'] = null;
493 $this->_xh['lv'] = 3;
496 // drop through intentionally if nil extension not enabled
500 case 'METHORESPONSE':
503 // End of INVALID ELEMENT!
504 // shall we add an assert here for unreachable code???
511 * Used in decoding xmlrpc requests/responses without rebuilding xmlrpc Values.
512 * @param resource $parser
513 * @param string $name
515 public function xmlrpc_ee_fast($parser, $name)
517 $this->xmlrpc_ee($parser, $name, false);
521 * xml parser handler function for character data.
522 * @param resource $parser
523 * @param string $data
525 public function xmlrpc_cd($parser, $data)
527 // skip processing if xml fault already detected
528 if ($this->_xh['isf'] < 2) {
529 // "lookforvalue==3" means that we've found an entire value
530 // and should discard any further character data
531 if ($this->_xh['lv'] != 3) {
532 $this->_xh['ac'] .= $data;
538 * xml parser handler function for 'other stuff', ie. not char data or
539 * element start/end tag. In fact it only gets called on unknown entities...
543 public function xmlrpc_dh($parser, $data)
545 // skip processing if xml fault already detected
546 if ($this->_xh['isf'] < 2) {
547 if (substr($data, 0, 1) == '&' && substr($data, -1, 1) == ';') {
548 $this->_xh['ac'] .= $data;
556 * xml charset encoding guessing helper function.
557 * Tries to determine the charset encoding of an XML chunk received over HTTP.
558 * NB: according to the spec (RFC 3023), if text/xml content-type is received over HTTP without a content-type,
559 * we SHOULD assume it is strictly US-ASCII. But we try to be more tolerant of non conforming (legacy?) clients/servers,
560 * which will be most probably using UTF-8 anyway...
561 * In order of importance checks:
565 * 4. guesses using mb_detect_encoding()
567 * @param string $httpHeader the http Content-type header
568 * @param string $xmlChunk xml content buffer
569 * @param string $encodingPrefs comma separated list of character encodings to be used as default (when mb extension is enabled).
570 * This can also be set globally using PhpXmlRpc::$xmlrpc_detectencodings
571 * @return string the encoding determined. Null if it can't be determined and mbstring is enabled,
572 * PhpXmlRpc::$xmlrpc_defencoding if it can't be determined and mbstring is not enabled
574 * @todo explore usage of mb_http_input(): does it detect http headers + post data? if so, use it instead of hand-detection!!!
576 public static function guessEncoding($httpHeader = '', $xmlChunk = '', $encodingPrefs = null)
578 // discussion: see http://www.yale.edu/pclt/encoding/
579 // 1 - test if encoding is specified in HTTP HEADERS
582 // LWS: (\13\10)?( |\t)+
583 // token: (any char but excluded stuff)+
584 // quoted string: " (any char but double quotes and control chars)* "
585 // header: Content-type = ...; charset=value(; ...)*
586 // where value is of type token, no LWS allowed between 'charset' and value
587 // Note: we do not check for invalid chars in VALUE:
588 // this had better be done using pure ereg as below
589 // Note 2: we might be removing whitespace/tabs that ought to be left in if
590 // the received charset is a quoted string. But nobody uses such charset names...
592 /// @todo this test will pass if ANY header has charset specification, not only Content-Type. Fix it?
594 if (preg_match('/;\s*charset\s*=([^;]+)/i', $httpHeader, $matches)) {
595 return strtoupper(trim($matches[1], " \t\""));
598 // 2 - scan the first bytes of the data for a UTF-16 (or other) BOM pattern
599 // (source: http://www.w3.org/TR/2000/REC-xml-20001006)
600 // NOTE: actually, according to the spec, even if we find the BOM and determine
601 // an encoding, we should check if there is an encoding specified
602 // in the xml declaration, and verify if they match.
603 /// @todo implement check as described above?
604 /// @todo implement check for first bytes of string even without a BOM? (It sure looks harder than for cases WITH a BOM)
605 if (preg_match('/^(\x00\x00\xFE\xFF|\xFF\xFE\x00\x00|\x00\x00\xFF\xFE|\xFE\xFF\x00\x00)/', $xmlChunk)) {
607 } elseif (preg_match('/^(\xFE\xFF|\xFF\xFE)/', $xmlChunk)) {
609 } elseif (preg_match('/^(\xEF\xBB\xBF)/', $xmlChunk)) {
613 // 3 - test if encoding is specified in the xml declaration
615 // SPACE: (#x20 | #x9 | #xD | #xA)+ === [ \x9\xD\xA]+
616 // EQ: SPACE?=SPACE? === [ \x9\xD\xA]*=[ \x9\xD\xA]*
617 if (preg_match('/^<\?xml\s+version\s*=\s*' . "((?:\"[a-zA-Z0-9_.:-]+\")|(?:'[a-zA-Z0-9_.:-]+'))" .
618 '\s+encoding\s*=\s*' . "((?:\"[A-Za-z][A-Za-z0-9._-]*\")|(?:'[A-Za-z][A-Za-z0-9._-]*'))/",
619 $xmlChunk, $matches)) {
620 return strtoupper(substr($matches[2], 1, -1));
623 // 4 - if mbstring is available, let it do the guesswork
624 if (extension_loaded('mbstring')) {
625 if ($encodingPrefs == null && PhpXmlRpc::$xmlrpc_detectencodings != null) {
626 $encodingPrefs = PhpXmlRpc::$xmlrpc_detectencodings;
628 if ($encodingPrefs) {
629 $enc = mb_detect_encoding($xmlChunk, $encodingPrefs);
631 $enc = mb_detect_encoding($xmlChunk);
633 // NB: mb_detect likes to call it ascii, xml parser likes to call it US_ASCII...
634 // IANA also likes better US-ASCII, so go with it
635 if ($enc == 'ASCII') {
641 // no encoding specified: as per HTTP1.1 assume it is iso-8859-1?
642 // Both RFC 2616 (HTTP 1.1) and 1945 (HTTP 1.0) clearly state that for text/xxx content types
643 // this should be the standard. And we should be getting text/xml as request and response.
644 // BUT we have to be backward compatible with the lib, which always used UTF-8 as default...
645 return PhpXmlRpc::$xmlrpc_defencoding;
650 * Helper function: checks if an xml chunk as a charset declaration (BOM or in the xml declaration)
652 * @param string $xmlChunk
655 public static function hasEncoding($xmlChunk)
657 // scan the first bytes of the data for a UTF-16 (or other) BOM pattern
658 // (source: http://www.w3.org/TR/2000/REC-xml-20001006)
659 if (preg_match('/^(\x00\x00\xFE\xFF|\xFF\xFE\x00\x00|\x00\x00\xFF\xFE|\xFE\xFF\x00\x00)/', $xmlChunk)) {
661 } elseif (preg_match('/^(\xFE\xFF|\xFF\xFE)/', $xmlChunk)) {
663 } elseif (preg_match('/^(\xEF\xBB\xBF)/', $xmlChunk)) {
667 // test if encoding is specified in the xml declaration
669 // SPACE: (#x20 | #x9 | #xD | #xA)+ === [ \x9\xD\xA]+
670 // EQ: SPACE?=SPACE? === [ \x9\xD\xA]*=[ \x9\xD\xA]*
671 if (preg_match('/^<\?xml\s+version\s*=\s*' . "((?:\"[a-zA-Z0-9_.:-]+\")|(?:'[a-zA-Z0-9_.:-]+'))" .
672 '\s+encoding\s*=\s*' . "((?:\"[A-Za-z][A-Za-z0-9._-]*\")|(?:'[A-Za-z][A-Za-z0-9._-]*'))/",
673 $xmlChunk, $matches)) {