Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121204
Feedback-ID: i8414410d:Fastmail
User-Agent: Cyrus-JMAP/3.9.0-alpha0-958-g1b1b911df8-fm-20230927.002-g1b1b911d
MIME-Version: 1.0
Message-ID: <71481f6e-6afc-425f-8d7c-ded84fc79e1b@app.fastmail.com>
In-Reply-To: <c1e56578-e3da-4814-94f9-74af139721bd@gmail.com>
References: <c1e56578-e3da-4814-94f9-74af139721bd@gmail.com>
Date: Sun, 01 Oct 2023 10:43:08 -0500
To: "php internals" <internals@lists.php.net>
Content-Type: text/plain
Subject: Re: [PHP-DEV] XSLTProcessor max depth
From: larry@garfieldtech.com ("Larry Garfield")

On Sat, Sep 30, 2023, at 10:18 AM, Niels Dossche wrote:
> Hi internals
>
> I'm looking to address https://bugs.php.net/bug.php?id=71571.
> TL;DR: XSL has a maximum recursion depth, and it may even depend on the 
> distro/OS config.
> For complex inputs you may reach this limit, but PHP offers no way to 
> change that limit.
>
> As we already have methods in XSLTProcessor to configure certain things 
> (e.g. setProfiling, setSecurityPrefs), it may be an idea to add 
> `setMaxDepth(int $depth)` or something alike.
>
> Unfortunately, XSLTProcessor is non-final, so if a user class extends 
> this class and coincidentally already has a method with the same name 
> but incompatible signature, then they would get a compile error.
>
> What do you think?
>
> Kind regards
> Niels


In context, I cannot imagine why someone would have a setMaxDepth() method with that name, since, AIUI, they wouldn't be able to actually set the max depth.  So I think the chances of there being a conflict are extremely remote, and an acceptable risk.

This could be verified by doing a "top packages" scan using Nikita's script, which is probably a good step anyway.

--Larry Garfield