Fix phpGH-18090: DOM: Svg attributes and tag names are being lowercased

nielsdos · nielsdos · commit 0154bb515cc1 · 2025-03-16T19:29:57.000+01:00
diff --git a/ext/dom/html5_parser.c b/ext/dom/html5_parser.c
@@ -138,7 +138,9 @@ static lexbor_libxml2_bridge_status lexbor_libxml2_bridge_convert(
              * If a prefix:name format is used, then the local name will be "prefix:name" and the prefix will be empty.
              * There is however still somewhat of a concept of namespaces. There are three: HTML (the default), SVG, and MATHML. */
             lxb_dom_element_t *element = lxb_dom_interface_element(node);
-            const lxb_char_t *name = lxb_dom_element_local_name(element, NULL);
+            const lxb_char_t *name = lxb_dom_element_qualified_name(element, NULL);
+            ZEND_ASSERT(!element->node.prefix);
+
             xmlNodePtr lxml_element = xmlNewDocNode(lxml_doc, NULL, name, NULL);
             if (UNEXPECTED(lxml_element == NULL)) {
                 retval = LEXBOR_LIBXML2_BRIDGE_STATUS_OOM;
@@ -203,7 +205,13 @@ static lexbor_libxml2_bridge_status lexbor_libxml2_bridge_convert(
             for (lxb_dom_attr_t *attr = element->first_attr; attr != NULL; attr = attr->next) {
                 /* Same namespace remark as for elements */
                 size_t local_name_length, value_length;
-                const lxb_char_t *local_name = lxb_dom_attr_local_name(attr, &local_name_length);
+                const lxb_char_t *local_name = lxb_dom_attr_qualified_name(attr, &local_name_length);
+                if (attr->node.prefix) {
+                    const char *pos = strchr((const char *) local_name, ':');
+                    if (EXPECTED(pos)) {
+                        local_name = (const lxb_char_t *) pos + 1;
+                    }
+                }
                 const lxb_char_t *value = lxb_dom_attr_value(attr, &value_length);
 
                 if (UNEXPECTED(local_name_length >= INT_MAX || value_length >= INT_MAX)) {
diff --git a/ext/dom/tests/modern/html/parser/gh18090.phpt b/ext/dom/tests/modern/html/parser/gh18090.phpt
@@ -0,0 +1,18 @@
+--TEST--
+GH-18090 (Svg attributes and tag names are being lowercased)
+--EXTENSIONS--
+dom
+--FILE--
+<?php
+echo \Dom\HTMLDocument::createFromString('<html><body><svg VIEWBOX="1 2 3 4"></svg></html>', LIBXML_NOERROR)->saveHTML(), "\n";
+
+echo \Dom\HTMLDocument::createFromString('<html><body CLASS="no"><svg VIEWBOX="1 2 3 4"><feSpotLight x="10" y="10" z="50" pointsAtX="100" pointsAtY="100" limitingConeAngle="
+10" /></svg></html>', LIBXML_NOERROR)->saveHTML(), "\n";
+
+echo \Dom\HTMLDocument::createFromString('<html><body><svg VIEWBOX="1 2 3 4"></svg></html>', LIBXML_NOERROR)->querySelector('svg')->attributes[0]->name, "\n";
+?>
+--EXPECT--
+<html><head></head><body><svg viewBox="1 2 3 4"></svg></body></html>
+<html><head></head><body class="no"><svg viewBox="1 2 3 4"><feSpotLight x="10" y="10" z="50" pointsAtX="100" pointsAtY="100" limitingConeAngle="
+10"></feSpotLight></svg></body></html>
+viewBox
diff --git a/ext/dom/tests/modern/html/parser/predefined_namespaces.phpt b/ext/dom/tests/modern/html/parser/predefined_namespaces.phpt
@@ -47,7 +47,7 @@ echo $dom->saveXml();
 svg http://www.w3.org/2000/svg
   Attribute: width (NONE)
   Attribute: height (NONE)
-  Attribute: viewbox (NONE)
+  Attribute: viewBox (NONE)
 rect http://www.w3.org/2000/svg
   Attribute: id (NONE)
   Attribute: x (NONE)
@@ -65,7 +65,7 @@ svg http://www.w3.org/1998/Math/MathML
     <title>Test</title>
 </head>
 <body>
-    <svg width="100" height="100" viewbox="0 0 4 2">
+    <svg width="100" height="100" viewBox="0 0 4 2">
         <rect id="rectangle" x="10" y="20" width="90" height="60">
         </rect>
     </svg>
@@ -85,7 +85,7 @@ svg http://www.w3.org/1998/Math/MathML
     <title>Test</title>
 </head>
 <body>
-    <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100" viewbox="0 0 4 2">
+    <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100" viewBox="0 0 4 2">
         <rect id="rectangle" x="10" y="20" width="90" height="60">
         </rect>
     </svg>
