Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103703
To: PHP internals <internals@lists.php.net>
Message-ID: <519a993a-98fb-8343-6565-29b8245ada63@gmx.de>
Date: Wed, 9 Jan 2019 13:28:07 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.4.0
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: 7bit
Subject: What to do with ext/xmlrpc?
From: cmbecker69@gmx.de ("Christoph M. Becker")

Hi!

The problem with ext/xmlrpc is that it relies on libxmlrpc-epi[1], which
looks abandoned.  Even worse, we're bundling a modified 0.51[2], while
the latest version is 0.54.1[3].  This is exacerbated by the fact that
the system library is usually build against libexpat, but the bundled
library is likely to be build against libxml2 using our compat layer.

We most recently fixed two security issues[4], but it is likely not
clear whether these may affect latest system libraries as well, and
there are more issues.

So unless a maintainer steps forward, it might be best to deprecate
and/or unbundle ext/xmlrpc.

Thoughts?

[1] <https://sourceforge.net/projects/xmlrpc-epi/>
[2]
<https://github.com/php/php-src/blob/php-7.3.1/ext/xmlrpc/libxmlrpc/xmlrpc.h#L47>
[3] <https://sourceforge.net/projects/xmlrpc-epi/files/xmlrpc-epi-base/>
[4] <https://github.com/php/php-src/blob/php-7.3.1/NEWS#L89-L90>

-- 
Christoph M. Becker