PHP XML_Unserializer is removing some important characters

[dt84]

Hello Everyone,

This is a PHP/XML query.

I'm using XML_Unserialize r from the PEAR package to convert some XML to a php array. The XML is very basic:

<response status="SUCCESS ">
<object>some character data</object>
</response>

The problem I'm facing is that if "some character data" contains &lt; or &gt; (for < and >), these characters are being removed from the result.

"some character data" is usually HTML so what it needs to do is convert the &lt; and &gt; back to < and > rather than delete them.

I've looked through the XML_Unserialize r code but haven't been able to determine when the characters are deleted.

Any help is greatly appreciated.

David.

[Dormilich]

when I used the wddx (de)serializer, it was converting the & of my entities to &amp; and back. it could be (tho I don't know the PEAR unserializer enough) your &lt; and &gt; are converted to < and > and then removed for security reasons???

you could test what happens to &amp;lt; maybe this can give you a hint....

[dt84]

Thanks Dormilich for the reply,

I tried it with "&amp;lt;" and the output was "lt;" so it appears XML_Unserialize r is also not converting "&amp;" to "&".

Here's the code I'm using to test:

[PHP]
require_once('X ML/Unserializer.ph p');

$some_text = '&lt;strong&gt; bold text&lt;strong& gt;';
$body = '<?xml version="1.0" encoding="UTF-8"?><respons e status="SUCCESS "><object>'.$so me_text.'</object></response>';

$unserializer = new XML_Unserialize r();
$result = $unserializer->unserialize($b ody);
if (!PEAR::isError ($result)) {
$results = $unserializer->getUnserialize dData();
if (empty($results )) {
echo 'EMPTY!';
}
else {
echo $results['object'];
}
}
else {
echo 'ERROR!';
}
[/PHP]

The above code should echo bold text but it's currently echoing "strongbold textstrong".

I'm not sure how to determine if it's a security issue.

David.

[Dormilich]

having a look at the docs, they call the unserializer
[PHP]XML_Unserialize r::unserialize (string $data [, boolean $isFile = FALSE [, array $options = NULL]])
string XML_Unserialize r::getUnseriali zedData ()[/PHP]
maybe you need to redefine some options?

[naznaz]

See http://forums.phpfreaks.com/topic/17...gt-from-cdata/