|
4612ce30
|
2022-04-21T03:52:52
|
|
Implement xpath1() XPointer scheme
See https://www.w3.org/2005/04/xpointer-schemes/
|
|
|
57b81c20
|
2022-03-05T18:20:29
|
|
Normalize XPath strings in-place
Simplify the code and fix a potential memory leak.
Fixes #343.
|
|
|
5408c10c
|
2022-02-04T14:00:09
|
|
Don't normalize namespace URIs in XPointer xmlns() scheme
Namespace URIs should be compared without escaping or unescaping:
https://www.w3.org/TR/REC-xml-names/#NSNameComparison
Fixes #289.
|
|
|
c2f4da1a
|
2017-05-21T22:08:50
|
|
Improve XPath predicate and filter evaluation
Consolidate code paths evaluating XPath predicates and filters.
Don't push context node on stack when evaluating predicates. I have no
idea why this was done. It seems completely useless and trying to pop
the context node from a corrupted stack has already caused security
issues.
Filter nodesets in-place and don't create node sets with NULL gaps which
allows to simplify merging a great deal. Simply move matched nodes
backward and create a compact node set.
Merge xmlXPathCompOpEvalPositionalPredicate into
xmlXPathCompOpEvalPredicate.
|
|
|
30a6533e
|
2019-03-08T12:15:17
|
|
Fix float casts in xmlXPathSubstringFunction
Rewrite conversion of double to int in xmlXPathSubstringFunction, adding
range checks to avoid undefined behavior. Make sure to add start and
length as floating-point numbers before converting to int. Fix a bug
when rounding negative start indices.
Remove unneeded calls to xmlXPathIs{Inf,NaN} and rely on IEEE math
instead. Avoid computing the string length. xmlUTF8Strsub works as
expected if the length of the requested substring exceeds the input.
Found with libFuzzer and UBSan.
|
|
|
5af594d8
|
2017-10-07T14:54:45
|
|
Fix comparison of nodesets to strings
Fix two bugs in xmlXPathNodeValHash which could lead to errors when
comparing nodesets to strings:
- Only use contents of text nodes to compute the hash for element nodes.
Comments, PIs, and other node types don't affect the string-value and
must be ignored.
- Reset `string` to NULL for node types other than text.
Reported by Aleksei on the mailing list:
https://mail.gnome.org/archives/xml/2017-September/msg00016.html
|
|
|
7482f41f
|
2017-06-01T22:00:19
|
|
Check for integer overflow in xmlXPathFormatNumber
Check for overflow before casting double to int.
Found with afl-fuzz and UBSan.
|
|
|
f4029cd4
|
2016-04-21T16:37:26
|
|
Check XPath exponents for overflow
Avoid undefined behavior and wrong results with huge exponents.
Found with afl-fuzz and UBSan.
|
|
|
a58331a6
|
2017-05-29T21:02:21
|
|
Check for overflow in xmlXPathIsPositionalPredicate
Avoid undefined behavior when casting from double to int.
Found with afl-fuzz and UBSan.
|
|
|
a851868a
|
2017-05-29T20:14:42
|
|
Parse small XPath numbers more accurately
Don't count leading zeros towards the fraction size limit. This allows
to parse numbers like
0.0000000000000000000000000000000000000000000000000000000001
which is the only standard-conformant way to represent such numbers, as
scientific notation isn't allowed in XPath 1.0. (It is allowed in XPath
2.0 and in libxml2 as an extension, though.)
Overall accuracy is still bad, see bug 783238.
|
|
|
4bebb030
|
2016-04-21T13:41:09
|
|
Rework XPath rounding functions
Use the C library's floor and ceil functions. The old code was overly
complicated for no apparent reason and could result in undefined
behavior when handling NaNs (found with afl-fuzz and UBSan).
Fix wrong comment in xmlXPathRoundFunction. The implementation was
already following the spec and rounding half up.
|
|
|
40f58521
|
2017-05-26T20:16:35
|
|
Fix axis traversal from attribute and namespace nodes
When traversing the "preceding" axis from an attribute node, we must
first go up to the attribute's containing element. Otherwise, text
children of other attributes could be returned. This made it possible
to hit a code path in xmlXPathNextAncestor which contained another bug:
The attribute node was initialized with the context node instead of the
current node. Normally, this code path is only hit via
xmlXPathNextAncestorOrSelf in which case the current and context node
are the same.
The combination of the two bugs could result in an infinite loop, found
with libFuzzer.
Traversing the "following" and the "preceding" axis from namespace nodes
should be handled similarly. This wasn't supported at all previously.
|
|
|
9ab01a27
|
2016-06-28T14:22:23
|
|
Fix XPointer paths beginning with range-to
The old code would invoke the broken xmlXPtrRangeToFunction. range-to
isn't really a function but a special kind of location step. Remove
this function and always handle range-to in the XPath code.
The old xmlXPtrRangeToFunction could also be abused to trigger a
use-after-free error with the potential for remote code execution.
Found with afl-fuzz.
Fixes CVE-2016-5131.
|
|
|
d8083bf7
|
2016-06-25T12:35:50
|
|
Fix NULL pointer deref in XPointer range-to
- Check for errors after evaluating first operand.
- Add sanity check for empty stack.
Found with afl-fuzz.
|
|
|
6eb0894a
|
2016-05-05T16:49:00
|
|
Fix memory leak with XPath namespace nodes
Set hasNsNodes to 1 when adding namespace nodes via XP_TEST_HIT.
|
|
|
82b73039
|
2016-04-30T17:53:10
|
|
Fix namespace axis traversal
When the namespace axis is traversed in "toBool" mode, the traversal
can exit early, before visiting all nodes. In this case, the XPath
context still contains a non-NULL tmpNsList.
This means that
- the check when to start a new traversal was wrong and
- the tmpNsList could be leaked.
Fixes bug #750037 and, by accident, bug #756075:
https://bugzilla.gnome.org/show_bug.cgi?id=750037
https://bugzilla.gnome.org/show_bug.cgi?id=756075
|
|
|
839689a9
|
2016-04-27T18:00:12
|
|
Don't recurse into OP_VALUEs in xmlXPathOptimizeExpression
The ch1 slot of OP_VALUEs contains an invalid value. Ignore it.
Fixes bug #760325:
https://bugzilla.gnome.org/show_bug.cgi?id=760325
|
|
|
f39fd66e
|
2016-04-27T03:01:16
|
|
Fix namespace::node() XPath expression
Make sure that xmlXPathNodeSetAddNs is called for namespace nodes when
matched with a namespace::node() step. This correctly sets the parent
of namespace nodes. Note that xmlXPathNodeSetAddNs must only be called
if working on the namespace axis. Otherwise, the context node is not
the parent of the namespace node and the standard XP_TEST_HIT macro
must be invoked. This explains the errors in the C14N tests that the
old TODO comment mentioned.
|
|
|
e2893903
|
2016-04-21T19:19:23
|
|
Fix parsing of NCNames in XPath
The NCName parser would allow any NameChar as start character. For
example, the following XPath expressions would compile:
self::-abc
self::0abc
self::.abc
|
|
|
02b252d7
|
2015-03-08T17:00:37
|
|
Regression test for bug #695699
|
|
|
342658a1
|
2015-03-08T16:46:04
|
|
Add a couple of XPath tests
|
|
|
f6aaabce
|
2015-03-08T16:05:26
|
|
Allow attributes on descendant-or-self axis
If the context node is an attribute, the attribute itself is on the
descendant-or-self axis. The principal node type of this axis is element,
so the only node test that can return the attribute is "node()". In other
words, "@attr/descendant-or-self::node()" is equivalent to "@attr".
This matches the behavior of Saxon-CE.
|
|
bb2074e8
|
2006-01-05T14:49:40
|
|
Added regression tests for the latest XPath/pattern fixes.
* test/XPath/docs/nodes test/XPath/tests/nodespat
result/XPath/tests/nodespat: Added regression tests for
the latest XPath/pattern fixes.
|
|
ea152c05
|
2005-06-09T18:12:28
|
|
Further enhancement for XPath streaming, consolidated with schemas usage
* pattern.c, xpath.c, include/libxml/pattern.h: Further
enhancement for XPath streaming, consolidated with
schemas usage of pattern.c. Added a new enum
xmlPatternFlags.
* doc/*, testapi.c, elfgcchack.h: updated to reflect new
enum.
* test/XPath/tests/mixedpat, test/XPath/docs/mixed,
result/XPath/mixedpat: added regression test for problems
reported in bug306348
|
|
4ddaa56d
|
2005-04-06T14:09:08
|
|
fixed the bug in lang() as raised by Elliotte Rusty Harold added a
* xpath.c: fixed the bug in lang() as raised by Elliotte Rusty Harold
* result/XPath/tests/langsimple test/XPath/tests/langsimple
test/XPath/docs/lang: added a regression test
Daniel
|
|
|
9a237c9d
|
2003-02-13T15:52:58
|
|
improved the script accordingly to the XInclude regression tests updates
* check-xinclude-test-suite.py: improved the script accordingly
to the XInclude regression tests updates
* xpointer.c: Implemented XPointer element() Scheme W3C PR of 13
November 2002
* result/XPath/xptr/chapterschildseq result/XPath/xptr/vidchildseq
test/XPath/xptr/chapterschildseq test/XPath/xptr/vidchildseq:
augmented the Xpointer testsuite for the element() scheme
Daniel
|
|
|
fdc9156a
|
2002-07-01T21:52:03
|
|
applied patch from Richard Jinks for the namespace axis + fixed a memory
* xpath.c: applied patch from Richard Jinks for the namespace
axis + fixed a memory error.
* parser.c parserInternals.c: applied patches from Peter Jacobi
removing ctxt->token for good.
* xmlschemas.c xmlschemastypes.c: fixed a few memory leaks
popped out by the regression tests.
* Makefile.am: patch for threads makefile from Gary Pennington
Daniel
|
|
|
9e412302
|
2002-06-10T15:59:44
|
|
patch from Richard Jinks for XPath substring() function new set of tests
* xpath.c: patch from Richard Jinks for XPath substring() function
* result/XPath/expr/strings test/XPath/expr/strings: new set of tests
Daniel
|
|
|
eca82810
|
2002-04-24T11:42:02
|
|
another XPath conformance patch from Richard Jinks Daniel
* test/XPath/expr/floats test/XPath/expr/functions
result/XPath/expr/floats result/XPath/expr/functions
xpath.c: another XPath conformance patch from Richard Jinks
Daniel
|
|
|
0eafdef9
|
2002-04-10T16:14:34
|
|
another patch from Richard Jinks for substring conformance update of the
* xpath.c: another patch from Richard Jinks for substring conformance
* test/XPath/expr/floats test/XPath/expr/strings
result/XPath/expr/floats result/XPath/expr/strings: update of the
test suite to check those.
Daniel
|
|
|
21458c85
|
2002-03-27T16:12:22
|
|
more patches from Richard Jinks Updated tests though they show a
* trionan.c trionan.h xpath.c: more patches from Richard Jinks
* test/XPath/expr/compare test/XPath/expr/equality
test/XPath/expr/floats test/XPath/expr/functions
test/XPath/expr/strings result/XPath/expr/compare
result/XPath/expr/equality result/XPath/expr/floats
result/XPath/expr/functions result/XPath/expr/strings: Updated
tests though they show a divergence on Linux
Daniel
|
|
70a9da54
|
2001-04-21T16:57:29
|
|
trio upgrade and integration
|
|
|
d8df6c0e
|
2001-04-05T16:54:14
|
|
Fixes in the plane: - xpath.c: fixed a [] evaluation problem reported -
Fixes in the plane:
- xpath.c: fixed a [] evaluation problem reported
- test/XPath/tests/simpleaddr: extended test
- result/XPath/simpleaddr: updated result
Daniel
|
|
|
4b637079
|
2001-02-21T21:52:55
|
|
- xpath.c: finally implemented xmlXPathCompareNodeSets
- test/XPath/expr/floats results/XPath/expr/floats: added
a test for float expressions
Daniel
|
|
|
f62ceffb
|
2000-11-24T23:36:01
|
|
General fixes, XPointer improvements:
- HTMLparser.c: some fixes on auto-open of html/head/body
- encoding.c: fixed a compilation error on some gcc env
- xpath.c xpointer.[ch] xpathInternals.h: improved the
XPointer implementation
- test/XPath/xptr/strpoint test/XPath/xptr/strrange3: added
related XPointer tests and associated results
Daniel
|
|
|
2ffc3591
|
2000-10-30T15:36:47
|
|
- parser.[ch]: added xmlIOParseDTD()
- xpointer.c: added support for the 2 extra parameters of
string-range, fixed a stoopid error when '0' was present
in XPointer expressions
- test/XPath/xptr/strrange2 result/XPath/xptr/strrange2: added
testsuite for the above
Daniel
|
|
|
ff9c3307
|
2000-10-13T16:38:25
|
|
More work on XPointer
- xpath.c xpointer.c: XPointer reorder of ranges start/end and
string-range for empty strings
- test/XPath/docs/str test/XPath/xptr/chaptersrange
test/XPath/xptr/strrange: augmented the XPointer testsuite
Daniel
|
|
|
c2df4cde
|
2000-10-12T23:15:24
|
|
Going forward in XPointer implementation:
- testXPath.c xpath.[ch]: moved some debug functions to xpath core
- xpointer.c: implemented string-range() at least a good first version
- test/XPath/docs/str test/XPath/xptr/strrange
result/XPath/xptr/strrange: the string-range() tests
Daniel
|
|
|
c8df0aaf
|
2000-10-10T23:50:30
|
|
Added XPointer: - configure.in Makefile.am include/makefile.am: adding
Added XPointer:
- configure.in Makefile.am include/makefile.am: adding XPointer
and XPtrtests target
- xpointer.[ch] : new files for XPointer support
- test/XPath/xptr result/XPath/xptr: added XPointer testsuite and
more XPath tests
Daniel
|
|
|
e8282edd
|
2000-10-10T23:01:31
|
|
More work toward 2.2.5, integrated a number of patches
- configure.in Makefile.am win32config.h.in: trying to cleanup
make distcheck .... huh ...
- include/Makefile.am include/win32config.h: new directory
for includes
- win32/Makefile.mingw win32/README.MSDev win32/libxml2/libxml2.dsp
updated teh makefiles and instructions for WIN32
- xpath.c: small fixes
- test/XPath/ results/XPath: updated the testcases and results
- HTMLparser.c nanohttp.c testXPath.c: incorporated provided or
suggested patches
- valid.c: fixed an ID bug
Daniel
|
|
|
ac260306
|
2000-10-04T13:33:43
|
|
More work and fixes on XPath:
- debugXML.c testXPath.c xpath.[ch]: More work on XPath/Xpointer,
incorporated "(TOM)" <ptittom@free.fr> patches rebuilt the XPath
examples with the extra test
Daniel
|
|
|
740abf5a
|
2000-10-02T23:04:54
|
|
Big XPath cleanup continues, one URI fix:
- xpath.[ch] debugXML.c testXPath.c: fixed the XPath evaluation
engine, should be far more stable, incorporated a new version of
preceding/following axis, need testing
- uri.c: fixed file:///c:/a/b/c problem
- test/XPath/tests/idsimple: augmented the XPath tests
Daniel
|
|
|
8b5dd83f
|
2000-10-01T20:28:44
|
|
- configure.in: releasing 2.2.4
- parser.[ch]: added xmlStrEqual()
- HTMLparser.c HTMLtree.c SAX.c debugXML.c entities.c parser.c
tree.c valid.c xlink.c xpath.c: converted all !xmlStrcmp to
use xmlStrEqual instead
- TODO: updated
- added an XPath test
Daniel
|
|
|
7c1206fc
|
1999-10-14T09:10:25
|
|
Revamped HTML parsing, lots of bug fixes for HTML stuff,
Added xmlValidGetValidElements and xmlValidGetPotentialChildren,
Completed and cleaned up the tests,
Added doc for new modules gnome-xml-xmlmemory.html and gnome-xml-nanohttp.html,
Daniel
|
|
|
b96e6438
|
1999-08-29T21:02:19
|
|
Release 1.6, lot of fixes, more validation, code cleanup, added namespace
on attributes, Daniel.
|
|
|
b05deb7f
|
1999-08-10T19:04:08
|
|
Huge commit: 1.5.0, XML validation, Xpath, bugfixes, examples .... Daniel
|
|
|
1566d3a9
|
1999-07-15T14:24:29
|
|
Added XPath code (http://www.w3.org/TR/xpath), updated HTML support and docs, Daniel
|