• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * xinclude.c : Code to implement XInclude processing
3  *
4  * World Wide Web Consortium W3C Last Call Working Draft 10 November 2003
5  * http://www.w3.org/TR/2003/WD-xinclude-20031110
6  *
7  * See Copyright for the status of this software.
8  *
9  * daniel@veillard.com
10  */
11 
12 #define IN_LIBXML
13 #include "libxml.h"
14 
15 #include <string.h>
16 #include <libxml/xmlmemory.h>
17 #include <libxml/tree.h>
18 #include <libxml/parser.h>
19 #include <libxml/uri.h>
20 #include <libxml/xpath.h>
21 #include <libxml/xpointer.h>
22 #include <libxml/parserInternals.h>
23 #include <libxml/xmlerror.h>
24 #include <libxml/encoding.h>
25 #include <libxml/globals.h>
26 
27 #ifdef LIBXML_XINCLUDE_ENABLED
28 #include <libxml/xinclude.h>
29 
30 #include "private/buf.h"
31 #include "private/error.h"
32 #include "private/tree.h"
33 #include "private/xinclude.h"
34 
35 #define XINCLUDE_MAX_DEPTH 40
36 
37 /* #define DEBUG_XINCLUDE */
38 #ifdef DEBUG_XINCLUDE
39 #ifdef LIBXML_DEBUG_ENABLED
40 #include <libxml/debugXML.h>
41 #endif
42 #endif
43 
44 /************************************************************************
45  *									*
46  *			XInclude context handling			*
47  *									*
48  ************************************************************************/
49 
50 /*
51  * An XInclude context
52  */
53 typedef xmlChar *xmlURL;
54 
55 typedef struct _xmlXIncludeRef xmlXIncludeRef;
56 typedef xmlXIncludeRef *xmlXIncludeRefPtr;
57 struct _xmlXIncludeRef {
58     xmlChar              *URI; /* the fully resolved resource URL */
59     xmlChar         *fragment; /* the fragment in the URI */
60     xmlNodePtr           elem; /* the xi:include element */
61     xmlNodePtr            inc; /* the included copy */
62     int                   xml; /* xml or txt */
63     int	             fallback; /* fallback was loaded */
64     int		      emptyFb; /* flag to show fallback empty */
65     int		    expanding; /* flag to detect inclusion loops */
66     int		      replace; /* should the node be replaced? */
67 };
68 
69 typedef struct _xmlXIncludeDoc xmlXIncludeDoc;
70 typedef xmlXIncludeDoc *xmlXIncludeDocPtr;
71 struct _xmlXIncludeDoc {
72     xmlDocPtr             doc; /* the parsed document */
73     xmlChar              *url; /* the URL */
74     int             expanding; /* flag to detect inclusion loops */
75 };
76 
77 typedef struct _xmlXIncludeTxt xmlXIncludeTxt;
78 typedef xmlXIncludeTxt *xmlXIncludeTxtPtr;
79 struct _xmlXIncludeTxt {
80     xmlChar		*text; /* text string */
81     xmlChar              *url; /* the URL */
82 };
83 
84 struct _xmlXIncludeCtxt {
85     xmlDocPtr             doc; /* the source document */
86     int                 incNr; /* number of includes */
87     int                incMax; /* size of includes tab */
88     xmlXIncludeRefPtr *incTab; /* array of included references */
89 
90     int                 txtNr; /* number of unparsed documents */
91     int                txtMax; /* size of unparsed documents tab */
92     xmlXIncludeTxt    *txtTab; /* array of unparsed documents */
93 
94     int                 urlNr; /* number of documents stacked */
95     int                urlMax; /* size of document stack */
96     xmlXIncludeDoc    *urlTab; /* document stack */
97 
98     int              nbErrors; /* the number of errors detected */
99     int              fatalErr; /* abort processing */
100     int                legacy; /* using XINCLUDE_OLD_NS */
101     int            parseFlags; /* the flags used for parsing XML documents */
102     xmlChar *		 base; /* the current xml:base */
103 
104     void            *_private; /* application data */
105 
106 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
107     unsigned long    incTotal; /* total number of processed inclusions */
108 #endif
109     int			depth; /* recursion depth */
110     int		     isStream; /* streaming mode */
111 };
112 
113 static xmlXIncludeRefPtr
114 xmlXIncludeExpandNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node);
115 
116 static int
117 xmlXIncludeLoadNode(xmlXIncludeCtxtPtr ctxt, xmlXIncludeRefPtr ref);
118 
119 static int
120 xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlNodePtr tree);
121 
122 
123 /************************************************************************
124  *									*
125  *			XInclude error handler				*
126  *									*
127  ************************************************************************/
128 
129 /**
130  * xmlXIncludeErrMemory:
131  * @extra:  extra information
132  *
133  * Handle an out of memory condition
134  */
135 static void
xmlXIncludeErrMemory(xmlXIncludeCtxtPtr ctxt,xmlNodePtr node,const char * extra)136 xmlXIncludeErrMemory(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node,
137                      const char *extra)
138 {
139     if (ctxt != NULL)
140 	ctxt->nbErrors++;
141     __xmlRaiseError(NULL, NULL, NULL, ctxt, node, XML_FROM_XINCLUDE,
142                     XML_ERR_NO_MEMORY, XML_ERR_ERROR, NULL, 0,
143 		    extra, NULL, NULL, 0, 0,
144 		    "Memory allocation failed : %s\n", extra);
145 }
146 
147 /**
148  * xmlXIncludeErr:
149  * @ctxt: the XInclude context
150  * @node: the context node
151  * @msg:  the error message
152  * @extra:  extra information
153  *
154  * Handle an XInclude error
155  */
156 static void LIBXML_ATTR_FORMAT(4,0)
xmlXIncludeErr(xmlXIncludeCtxtPtr ctxt,xmlNodePtr node,int error,const char * msg,const xmlChar * extra)157 xmlXIncludeErr(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node, int error,
158                const char *msg, const xmlChar *extra)
159 {
160     if (ctxt != NULL)
161 	ctxt->nbErrors++;
162     __xmlRaiseError(NULL, NULL, NULL, ctxt, node, XML_FROM_XINCLUDE,
163                     error, XML_ERR_ERROR, NULL, 0,
164 		    (const char *) extra, NULL, NULL, 0, 0,
165 		    msg, (const char *) extra);
166 }
167 
168 #if 0
169 /**
170  * xmlXIncludeWarn:
171  * @ctxt: the XInclude context
172  * @node: the context node
173  * @msg:  the error message
174  * @extra:  extra information
175  *
176  * Emit an XInclude warning.
177  */
178 static void LIBXML_ATTR_FORMAT(4,0)
179 xmlXIncludeWarn(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node, int error,
180                const char *msg, const xmlChar *extra)
181 {
182     __xmlRaiseError(NULL, NULL, NULL, ctxt, node, XML_FROM_XINCLUDE,
183                     error, XML_ERR_WARNING, NULL, 0,
184 		    (const char *) extra, NULL, NULL, 0, 0,
185 		    msg, (const char *) extra);
186 }
187 #endif
188 
189 /**
190  * xmlXIncludeGetProp:
191  * @ctxt:  the XInclude context
192  * @cur:  the node
193  * @name:  the attribute name
194  *
195  * Get an XInclude attribute
196  *
197  * Returns the value (to be freed) or NULL if not found
198  */
199 static xmlChar *
xmlXIncludeGetProp(xmlXIncludeCtxtPtr ctxt,xmlNodePtr cur,const xmlChar * name)200 xmlXIncludeGetProp(xmlXIncludeCtxtPtr ctxt, xmlNodePtr cur,
201                    const xmlChar *name) {
202     xmlChar *ret;
203 
204     ret = xmlGetNsProp(cur, XINCLUDE_NS, name);
205     if (ret != NULL)
206         return(ret);
207     if (ctxt->legacy != 0) {
208 	ret = xmlGetNsProp(cur, XINCLUDE_OLD_NS, name);
209 	if (ret != NULL)
210 	    return(ret);
211     }
212     ret = xmlGetProp(cur, name);
213     return(ret);
214 }
215 /**
216  * xmlXIncludeFreeRef:
217  * @ref: the XInclude reference
218  *
219  * Free an XInclude reference
220  */
221 static void
xmlXIncludeFreeRef(xmlXIncludeRefPtr ref)222 xmlXIncludeFreeRef(xmlXIncludeRefPtr ref) {
223     if (ref == NULL)
224 	return;
225 #ifdef DEBUG_XINCLUDE
226     xmlGenericError(xmlGenericErrorContext, "Freeing ref\n");
227 #endif
228     if (ref->URI != NULL)
229 	xmlFree(ref->URI);
230     if (ref->fragment != NULL)
231 	xmlFree(ref->fragment);
232     xmlFree(ref);
233 }
234 
235 /**
236  * xmlXIncludeNewRef:
237  * @ctxt: the XInclude context
238  * @URI:  the resource URI
239  * @elem:  the xi:include element
240  *
241  * Creates a new reference within an XInclude context
242  *
243  * Returns the new set
244  */
245 static xmlXIncludeRefPtr
xmlXIncludeNewRef(xmlXIncludeCtxtPtr ctxt,const xmlChar * URI,xmlNodePtr elem)246 xmlXIncludeNewRef(xmlXIncludeCtxtPtr ctxt, const xmlChar *URI,
247 	          xmlNodePtr elem) {
248     xmlXIncludeRefPtr ret;
249 
250 #ifdef DEBUG_XINCLUDE
251     xmlGenericError(xmlGenericErrorContext, "New ref %s\n", URI);
252 #endif
253     ret = (xmlXIncludeRefPtr) xmlMalloc(sizeof(xmlXIncludeRef));
254     if (ret == NULL) {
255         xmlXIncludeErrMemory(ctxt, elem, "growing XInclude context");
256 	return(NULL);
257     }
258     memset(ret, 0, sizeof(xmlXIncludeRef));
259     if (URI == NULL)
260 	ret->URI = NULL;
261     else
262 	ret->URI = xmlStrdup(URI);
263     ret->fragment = NULL;
264     ret->elem = elem;
265     ret->xml = 0;
266     ret->inc = NULL;
267     if (ctxt->incMax == 0) {
268 	ctxt->incMax = 4;
269         ctxt->incTab = (xmlXIncludeRefPtr *) xmlMalloc(ctxt->incMax *
270 					      sizeof(ctxt->incTab[0]));
271         if (ctxt->incTab == NULL) {
272 	    xmlXIncludeErrMemory(ctxt, elem, "growing XInclude context");
273 	    xmlXIncludeFreeRef(ret);
274 	    return(NULL);
275 	}
276     }
277     if (ctxt->incNr >= ctxt->incMax) {
278         xmlXIncludeRefPtr *tmp;
279         size_t newSize = ctxt->incMax * 2;
280 
281         tmp = (xmlXIncludeRefPtr *) xmlRealloc(ctxt->incTab,
282 	             newSize * sizeof(ctxt->incTab[0]));
283         if (tmp == NULL) {
284 	    xmlXIncludeErrMemory(ctxt, elem, "growing XInclude context");
285 	    xmlXIncludeFreeRef(ret);
286 	    return(NULL);
287 	}
288         ctxt->incTab = tmp;
289         ctxt->incMax *= 2;
290     }
291     ctxt->incTab[ctxt->incNr++] = ret;
292     return(ret);
293 }
294 
295 /**
296  * xmlXIncludeNewContext:
297  * @doc:  an XML Document
298  *
299  * Creates a new XInclude context
300  *
301  * Returns the new set
302  */
303 xmlXIncludeCtxtPtr
xmlXIncludeNewContext(xmlDocPtr doc)304 xmlXIncludeNewContext(xmlDocPtr doc) {
305     xmlXIncludeCtxtPtr ret;
306 
307 #ifdef DEBUG_XINCLUDE
308     xmlGenericError(xmlGenericErrorContext, "New context\n");
309 #endif
310     if (doc == NULL)
311 	return(NULL);
312     ret = (xmlXIncludeCtxtPtr) xmlMalloc(sizeof(xmlXIncludeCtxt));
313     if (ret == NULL) {
314 	xmlXIncludeErrMemory(NULL, (xmlNodePtr) doc,
315 	                     "creating XInclude context");
316 	return(NULL);
317     }
318     memset(ret, 0, sizeof(xmlXIncludeCtxt));
319     ret->doc = doc;
320     ret->incNr = 0;
321     ret->incMax = 0;
322     ret->incTab = NULL;
323     ret->nbErrors = 0;
324     return(ret);
325 }
326 
327 /**
328  * xmlXIncludeFreeContext:
329  * @ctxt: the XInclude context
330  *
331  * Free an XInclude context
332  */
333 void
xmlXIncludeFreeContext(xmlXIncludeCtxtPtr ctxt)334 xmlXIncludeFreeContext(xmlXIncludeCtxtPtr ctxt) {
335     int i;
336 
337 #ifdef DEBUG_XINCLUDE
338     xmlGenericError(xmlGenericErrorContext, "Freeing context\n");
339 #endif
340     if (ctxt == NULL)
341 	return;
342     if (ctxt->urlTab != NULL) {
343 	for (i = 0; i < ctxt->urlNr; i++) {
344 	    xmlFreeDoc(ctxt->urlTab[i].doc);
345 	    xmlFree(ctxt->urlTab[i].url);
346 	}
347 	xmlFree(ctxt->urlTab);
348     }
349     for (i = 0;i < ctxt->incNr;i++) {
350 	if (ctxt->incTab[i] != NULL)
351 	    xmlXIncludeFreeRef(ctxt->incTab[i]);
352     }
353     if (ctxt->incTab != NULL)
354 	xmlFree(ctxt->incTab);
355     if (ctxt->txtTab != NULL) {
356 	for (i = 0;i < ctxt->txtNr;i++) {
357 	    xmlFree(ctxt->txtTab[i].text);
358 	    xmlFree(ctxt->txtTab[i].url);
359 	}
360 	xmlFree(ctxt->txtTab);
361     }
362     if (ctxt->base != NULL) {
363         xmlFree(ctxt->base);
364     }
365     xmlFree(ctxt);
366 }
367 
368 /**
369  * xmlXIncludeParseFile:
370  * @ctxt:  the XInclude context
371  * @URL:  the URL or file path
372  *
373  * parse a document for XInclude
374  */
375 static xmlDocPtr
xmlXIncludeParseFile(xmlXIncludeCtxtPtr ctxt,const char * URL)376 xmlXIncludeParseFile(xmlXIncludeCtxtPtr ctxt, const char *URL) {
377     xmlDocPtr ret;
378     xmlParserCtxtPtr pctxt;
379     xmlParserInputPtr inputStream;
380 
381     xmlInitParser();
382 
383     pctxt = xmlNewParserCtxt();
384     if (pctxt == NULL) {
385 	xmlXIncludeErrMemory(ctxt, NULL, "cannot allocate parser context");
386 	return(NULL);
387     }
388 
389     /*
390      * pass in the application data to the parser context.
391      */
392     pctxt->_private = ctxt->_private;
393 
394     /*
395      * try to ensure that new documents included are actually
396      * built with the same dictionary as the including document.
397      */
398     if ((ctxt->doc != NULL) && (ctxt->doc->dict != NULL)) {
399        if (pctxt->dict != NULL)
400             xmlDictFree(pctxt->dict);
401 	pctxt->dict = ctxt->doc->dict;
402 	xmlDictReference(pctxt->dict);
403     }
404 
405     xmlCtxtUseOptions(pctxt, ctxt->parseFlags | XML_PARSE_DTDLOAD);
406 
407     /* Don't read from stdin. */
408     if ((URL != NULL) && (strcmp(URL, "-") == 0))
409         URL = "./-";
410 
411     inputStream = xmlLoadExternalEntity(URL, NULL, pctxt);
412     if (inputStream == NULL) {
413 	xmlFreeParserCtxt(pctxt);
414 	return(NULL);
415     }
416 
417     inputPush(pctxt, inputStream);
418 
419     if (pctxt->directory == NULL)
420         pctxt->directory = xmlParserGetDirectory(URL);
421 
422     pctxt->loadsubset |= XML_DETECT_IDS;
423 
424     xmlParseDocument(pctxt);
425 
426     if (pctxt->wellFormed) {
427         ret = pctxt->myDoc;
428     }
429     else {
430         ret = NULL;
431 	if (pctxt->myDoc != NULL)
432 	    xmlFreeDoc(pctxt->myDoc);
433         pctxt->myDoc = NULL;
434     }
435     xmlFreeParserCtxt(pctxt);
436 
437     return(ret);
438 }
439 
440 /**
441  * xmlXIncludeAddNode:
442  * @ctxt:  the XInclude context
443  * @cur:  the new node
444  *
445  * Add a new node to process to an XInclude context
446  */
447 static xmlXIncludeRefPtr
xmlXIncludeAddNode(xmlXIncludeCtxtPtr ctxt,xmlNodePtr cur)448 xmlXIncludeAddNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr cur) {
449     xmlXIncludeRefPtr ref;
450     xmlURIPtr uri;
451     xmlChar *URL;
452     xmlChar *fragment = NULL;
453     xmlChar *href;
454     xmlChar *parse;
455     xmlChar *base;
456     xmlChar *URI;
457     int xml = 1;
458     int local = 0;
459 
460 
461     if (ctxt == NULL)
462 	return(NULL);
463     if (cur == NULL)
464 	return(NULL);
465 
466 #ifdef DEBUG_XINCLUDE
467     xmlGenericError(xmlGenericErrorContext, "Add node\n");
468 #endif
469     /*
470      * read the attributes
471      */
472     href = xmlXIncludeGetProp(ctxt, cur, XINCLUDE_HREF);
473     if (href == NULL) {
474 	href = xmlStrdup(BAD_CAST ""); /* @@@@ href is now optional */
475 	if (href == NULL)
476 	    return(NULL);
477     }
478     parse = xmlXIncludeGetProp(ctxt, cur, XINCLUDE_PARSE);
479     if (parse != NULL) {
480 	if (xmlStrEqual(parse, XINCLUDE_PARSE_XML))
481 	    xml = 1;
482 	else if (xmlStrEqual(parse, XINCLUDE_PARSE_TEXT))
483 	    xml = 0;
484 	else {
485 	    xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_PARSE_VALUE,
486 	                   "invalid value %s for 'parse'\n", parse);
487 	    if (href != NULL)
488 		xmlFree(href);
489 	    if (parse != NULL)
490 		xmlFree(parse);
491 	    return(NULL);
492 	}
493     }
494 
495     /*
496      * compute the URI
497      */
498     base = xmlNodeGetBase(ctxt->doc, cur);
499     if (base == NULL) {
500 	URI = xmlBuildURI(href, ctxt->doc->URL);
501     } else {
502 	URI = xmlBuildURI(href, base);
503     }
504     if (URI == NULL) {
505 	xmlChar *escbase;
506 	xmlChar *eschref;
507 	/*
508 	 * Some escaping may be needed
509 	 */
510 	escbase = xmlURIEscape(base);
511 	eschref = xmlURIEscape(href);
512 	URI = xmlBuildURI(eschref, escbase);
513 	if (escbase != NULL)
514 	    xmlFree(escbase);
515 	if (eschref != NULL)
516 	    xmlFree(eschref);
517     }
518     if (parse != NULL)
519 	xmlFree(parse);
520     if (href != NULL)
521 	xmlFree(href);
522     if (base != NULL)
523 	xmlFree(base);
524     if (URI == NULL) {
525 	xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_HREF_URI,
526 	               "failed build URL\n", NULL);
527 	return(NULL);
528     }
529     fragment = xmlXIncludeGetProp(ctxt, cur, XINCLUDE_PARSE_XPOINTER);
530 
531     /*
532      * Check the URL and remove any fragment identifier
533      */
534     uri = xmlParseURI((const char *)URI);
535     if (uri == NULL) {
536 	xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_HREF_URI,
537 	               "invalid value URI %s\n", URI);
538 	if (fragment != NULL)
539 	    xmlFree(fragment);
540 	xmlFree(URI);
541 	return(NULL);
542     }
543 
544     if (uri->fragment != NULL) {
545         if (ctxt->legacy != 0) {
546 	    if (fragment == NULL) {
547 		fragment = (xmlChar *) uri->fragment;
548 	    } else {
549 		xmlFree(uri->fragment);
550 	    }
551 	} else {
552 	    xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_FRAGMENT_ID,
553        "Invalid fragment identifier in URI %s use the xpointer attribute\n",
554                            URI);
555 	    if (fragment != NULL)
556 	        xmlFree(fragment);
557 	    xmlFreeURI(uri);
558 	    xmlFree(URI);
559 	    return(NULL);
560 	}
561 	uri->fragment = NULL;
562     }
563     URL = xmlSaveUri(uri);
564     xmlFreeURI(uri);
565     if (URL == NULL) {
566 	xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_HREF_URI,
567 	               "invalid value URI %s\n", URI);
568 	if (fragment != NULL)
569 	    xmlFree(fragment);
570         xmlFree(URI);
571 	return(NULL);
572     }
573     xmlFree(URI);
574 
575     if (xmlStrEqual(URL, ctxt->doc->URL))
576 	local = 1;
577 
578     /*
579      * If local and xml then we need a fragment
580      */
581     if ((local == 1) && (xml == 1) &&
582         ((fragment == NULL) || (fragment[0] == 0))) {
583 	xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_RECURSION,
584 	               "detected a local recursion with no xpointer in %s\n",
585 		       URL);
586         xmlFree(URL);
587         xmlFree(fragment);
588 	return(NULL);
589     }
590 
591     ref = xmlXIncludeNewRef(ctxt, URL, cur);
592     xmlFree(URL);
593     if (ref == NULL) {
594         xmlFree(fragment);
595 	return(NULL);
596     }
597     ref->fragment = fragment;
598     ref->xml = xml;
599     return(ref);
600 }
601 
602 /**
603  * xmlXIncludeRecurseDoc:
604  * @ctxt:  the XInclude context
605  * @doc:  the new document
606  * @url:  the associated URL
607  *
608  * The XInclude recursive nature is handled at this point.
609  */
610 static void
xmlXIncludeRecurseDoc(xmlXIncludeCtxtPtr ctxt,xmlDocPtr doc,const xmlURL url ATTRIBUTE_UNUSED)611 xmlXIncludeRecurseDoc(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc,
612 	              const xmlURL url ATTRIBUTE_UNUSED) {
613     xmlDocPtr oldDoc;
614     xmlXIncludeRefPtr *oldIncTab;
615     int oldIncMax, oldIncNr, oldIsStream;
616     int i;
617 
618     oldDoc = ctxt->doc;
619     oldIncMax = ctxt->incMax;
620     oldIncNr = ctxt->incNr;
621     oldIncTab = ctxt->incTab;
622     oldIsStream = ctxt->isStream;
623     ctxt->doc = doc;
624     ctxt->incMax = 0;
625     ctxt->incNr = 0;
626     ctxt->incTab = NULL;
627     ctxt->isStream = 0;
628 
629     xmlXIncludeDoProcess(ctxt, xmlDocGetRootElement(doc));
630 
631     if (ctxt->incTab != NULL) {
632         for (i = 0; i < ctxt->incNr; i++)
633             xmlXIncludeFreeRef(ctxt->incTab[i]);
634         xmlFree(ctxt->incTab);
635     }
636 
637     ctxt->doc = oldDoc;
638     ctxt->incMax = oldIncMax;
639     ctxt->incNr = oldIncNr;
640     ctxt->incTab = oldIncTab;
641     ctxt->isStream = oldIsStream;
642 }
643 
644 /************************************************************************
645  *									*
646  *			Node copy with specific semantic		*
647  *									*
648  ************************************************************************/
649 
650 /**
651  * xmlXIncludeCopyNode:
652  * @ctxt:  the XInclude context
653  * @elem:  the element
654  * @copyChildren:  copy children instead of node if true
655  *
656  * Make a copy of the node while expanding nested XIncludes.
657  *
658  * Returns a node list, not a single node.
659  */
660 static xmlNodePtr
xmlXIncludeCopyNode(xmlXIncludeCtxtPtr ctxt,xmlNodePtr elem,int copyChildren)661 xmlXIncludeCopyNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr elem,
662                     int copyChildren) {
663     xmlNodePtr result = NULL;
664     xmlNodePtr insertParent = NULL;
665     xmlNodePtr insertLast = NULL;
666     xmlNodePtr cur;
667 
668     if (copyChildren) {
669         cur = elem->children;
670         if (cur == NULL)
671             return(NULL);
672     } else {
673         cur = elem;
674     }
675 
676     while (1) {
677         xmlNodePtr copy = NULL;
678         int recurse = 0;
679 
680         if ((cur->type == XML_DOCUMENT_NODE) ||
681             (cur->type == XML_DTD_NODE)) {
682             ;
683         } else if ((cur->type == XML_ELEMENT_NODE) &&
684                    (cur->ns != NULL) &&
685                    (xmlStrEqual(cur->name, XINCLUDE_NODE)) &&
686                    ((xmlStrEqual(cur->ns->href, XINCLUDE_NS)) ||
687                     (xmlStrEqual(cur->ns->href, XINCLUDE_OLD_NS)))) {
688             xmlXIncludeRefPtr ref = xmlXIncludeExpandNode(ctxt, cur);
689 
690             if (ref == NULL)
691                 goto error;
692             /*
693              * TODO: Insert XML_XINCLUDE_START and XML_XINCLUDE_END nodes
694              */
695             if (ref->inc != NULL) {
696                 copy = xmlStaticCopyNodeList(ref->inc, ctxt->doc,
697                                              insertParent);
698                 if (copy == NULL)
699                     goto error;
700             }
701         } else {
702             copy = xmlStaticCopyNode(cur, ctxt->doc, insertParent, 2);
703             if (copy == NULL)
704                 goto error;
705 
706             recurse = (cur->type != XML_ENTITY_REF_NODE) &&
707                       (cur->children != NULL);
708         }
709 
710         if (copy != NULL) {
711             if (result == NULL)
712                 result = copy;
713             if (insertLast != NULL) {
714                 insertLast->next = copy;
715                 copy->prev = insertLast;
716             } else if (insertParent != NULL) {
717                 insertParent->children = copy;
718             }
719             insertLast = copy;
720             while (insertLast->next != NULL) {
721                 insertLast = insertLast->next;
722             }
723         }
724 
725         if (recurse) {
726             cur = cur->children;
727             insertParent = insertLast;
728             insertLast = NULL;
729             continue;
730         }
731 
732         if (cur == elem)
733             return(result);
734 
735         while (cur->next == NULL) {
736             cur = cur->parent;
737             if (cur == elem)
738                 return(result);
739             insertParent->last = insertLast;
740             insertLast = insertParent;
741             insertParent = insertParent->parent;
742         }
743 
744         cur = cur->next;
745     }
746 
747 error:
748     xmlFreeNodeList(result);
749     return(NULL);
750 }
751 
752 #ifdef LIBXML_XPTR_LOCS_ENABLED
753 /**
754  * xmlXIncludeGetNthChild:
755  * @cur:  the node
756  * @no:  the child number
757  *
758  * Returns the @n'th element child of @cur or NULL
759  */
760 static xmlNodePtr
xmlXIncludeGetNthChild(xmlNodePtr cur,int no)761 xmlXIncludeGetNthChild(xmlNodePtr cur, int no) {
762     int i;
763     if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL))
764         return(NULL);
765     cur = cur->children;
766     for (i = 0;i <= no;cur = cur->next) {
767 	if (cur == NULL)
768 	    return(cur);
769 	if ((cur->type == XML_ELEMENT_NODE) ||
770 	    (cur->type == XML_DOCUMENT_NODE) ||
771 	    (cur->type == XML_HTML_DOCUMENT_NODE)) {
772 	    i++;
773 	    if (i == no)
774 		break;
775 	}
776     }
777     return(cur);
778 }
779 
780 xmlNodePtr xmlXPtrAdvanceNode(xmlNodePtr cur, int *level); /* in xpointer.c */
781 /**
782  * xmlXIncludeCopyRange:
783  * @ctxt:  the XInclude context
784  * @obj:  the XPointer result from the evaluation.
785  *
786  * Build a node list tree copy of the XPointer result.
787  *
788  * Returns an xmlNodePtr list or NULL.
789  *         The caller has to free the node tree.
790  */
791 static xmlNodePtr
xmlXIncludeCopyRange(xmlXIncludeCtxtPtr ctxt,xmlXPathObjectPtr range)792 xmlXIncludeCopyRange(xmlXIncludeCtxtPtr ctxt, xmlXPathObjectPtr range) {
793     /* pointers to generated nodes */
794     xmlNodePtr list = NULL, last = NULL, listParent = NULL;
795     xmlNodePtr tmp, tmp2;
796     /* pointers to traversal nodes */
797     xmlNodePtr start, cur, end;
798     int index1, index2;
799     int level = 0, lastLevel = 0, endLevel = 0, endFlag = 0;
800 
801     if ((ctxt == NULL) || (range == NULL))
802 	return(NULL);
803     if (range->type != XPATH_RANGE)
804 	return(NULL);
805     start = (xmlNodePtr) range->user;
806 
807     if ((start == NULL) || (start->type == XML_NAMESPACE_DECL))
808 	return(NULL);
809     end = range->user2;
810     if (end == NULL)
811 	return(xmlDocCopyNode(start, ctxt->doc, 1));
812     if (end->type == XML_NAMESPACE_DECL)
813         return(NULL);
814 
815     cur = start;
816     index1 = range->index;
817     index2 = range->index2;
818     /*
819      * level is depth of the current node under consideration
820      * list is the pointer to the root of the output tree
821      * listParent is a pointer to the parent of output tree (within
822        the included file) in case we need to add another level
823      * last is a pointer to the last node added to the output tree
824      * lastLevel is the depth of last (relative to the root)
825      */
826     while (cur != NULL) {
827 	/*
828 	 * Check if our output tree needs a parent
829 	 */
830 	if (level < 0) {
831 	    while (level < 0) {
832 	        /* copy must include namespaces and properties */
833 	        tmp2 = xmlDocCopyNode(listParent, ctxt->doc, 2);
834 	        xmlAddChild(tmp2, list);
835 	        list = tmp2;
836 	        listParent = listParent->parent;
837 	        level++;
838 	    }
839 	    last = list;
840 	    lastLevel = 0;
841 	}
842 	/*
843 	 * Check whether we need to change our insertion point
844 	 */
845 	while (level < lastLevel) {
846 	    last = last->parent;
847 	    lastLevel --;
848 	}
849 	if (cur == end) {	/* Are we at the end of the range? */
850 	    if (cur->type == XML_TEXT_NODE) {
851 		const xmlChar *content = cur->content;
852 		int len;
853 
854 		if (content == NULL) {
855 		    tmp = xmlNewDocTextLen(ctxt->doc, NULL, 0);
856 		} else {
857 		    len = index2;
858 		    if ((cur == start) && (index1 > 1)) {
859 			content += (index1 - 1);
860 			len -= (index1 - 1);
861 		    } else {
862 			len = index2;
863 		    }
864 		    tmp = xmlNewDocTextLen(ctxt->doc, content, len);
865 		}
866 		/* single sub text node selection */
867 		if (list == NULL)
868 		    return(tmp);
869 		/* prune and return full set */
870 		if (level == lastLevel)
871 		    xmlAddNextSibling(last, tmp);
872 		else
873 		    xmlAddChild(last, tmp);
874 		return(list);
875 	    } else {	/* ending node not a text node */
876 	        endLevel = level;	/* remember the level of the end node */
877 		endFlag = 1;
878 		/* last node - need to take care of properties + namespaces */
879 		tmp = xmlDocCopyNode(cur, ctxt->doc, 2);
880 		if (list == NULL) {
881 		    list = tmp;
882 		    listParent = cur->parent;
883 		    last = tmp;
884 		} else {
885 		    if (level == lastLevel)
886 			last = xmlAddNextSibling(last, tmp);
887 		    else {
888 			last = xmlAddChild(last, tmp);
889 			lastLevel = level;
890 		    }
891 		}
892 
893 		if (index2 > 1) {
894 		    end = xmlXIncludeGetNthChild(cur, index2 - 1);
895 		    index2 = 0;
896 		}
897 		if ((cur == start) && (index1 > 1)) {
898 		    cur = xmlXIncludeGetNthChild(cur, index1 - 1);
899 		    index1 = 0;
900 		}  else {
901 		    cur = cur->children;
902 		}
903 		level++;	/* increment level to show change */
904 		/*
905 		 * Now gather the remaining nodes from cur to end
906 		 */
907 		continue;	/* while */
908 	    }
909 	} else if (cur == start) {	/* Not at the end, are we at start? */
910 	    if ((cur->type == XML_TEXT_NODE) ||
911 		(cur->type == XML_CDATA_SECTION_NODE)) {
912 		const xmlChar *content = cur->content;
913 
914 		if (content == NULL) {
915 		    tmp = xmlNewDocTextLen(ctxt->doc, NULL, 0);
916 		} else {
917 		    if (index1 > 1) {
918 			content += (index1 - 1);
919 			index1 = 0;
920 		    }
921 		    tmp = xmlNewDocText(ctxt->doc, content);
922 		}
923 		last = list = tmp;
924 		listParent = cur->parent;
925 	    } else {		/* Not text node */
926 	        /*
927 		 * start of the range - need to take care of
928 		 * properties and namespaces
929 		 */
930 		tmp = xmlDocCopyNode(cur, ctxt->doc, 2);
931 		list = last = tmp;
932 		listParent = cur->parent;
933 		if (index1 > 1) {	/* Do we need to position? */
934 		    cur = xmlXIncludeGetNthChild(cur, index1 - 1);
935 		    level = lastLevel = 1;
936 		    index1 = 0;
937 		    /*
938 		     * Now gather the remaining nodes from cur to end
939 		     */
940 		    continue; /* while */
941 		}
942 	    }
943 	} else {
944 	    tmp = NULL;
945 	    switch (cur->type) {
946 		case XML_DTD_NODE:
947 		case XML_ELEMENT_DECL:
948 		case XML_ATTRIBUTE_DECL:
949 		case XML_ENTITY_NODE:
950 		    /* Do not copy DTD information */
951 		    break;
952 		case XML_ENTITY_DECL:
953 		    /* handle crossing entities -> stack needed */
954 		    break;
955 		case XML_XINCLUDE_START:
956 		case XML_XINCLUDE_END:
957 		    /* don't consider it part of the tree content */
958 		    break;
959 		case XML_ATTRIBUTE_NODE:
960 		    /* Humm, should not happen ! */
961 		    break;
962 		default:
963 		    /*
964 		     * Middle of the range - need to take care of
965 		     * properties and namespaces
966 		     */
967 		    tmp = xmlDocCopyNode(cur, ctxt->doc, 2);
968 		    break;
969 	    }
970 	    if (tmp != NULL) {
971 		if (level == lastLevel)
972 		    last = xmlAddNextSibling(last, tmp);
973 		else {
974 		    last = xmlAddChild(last, tmp);
975 		    lastLevel = level;
976 		}
977 	    }
978 	}
979 	/*
980 	 * Skip to next node in document order
981 	 */
982 	cur = xmlXPtrAdvanceNode(cur, &level);
983 	if (endFlag && (level >= endLevel))
984 	    break;
985     }
986     return(list);
987 }
988 #endif /* LIBXML_XPTR_LOCS_ENABLED */
989 
990 /**
991  * xmlXIncludeCopyXPointer:
992  * @ctxt:  the XInclude context
993  * @obj:  the XPointer result from the evaluation.
994  *
995  * Build a node list tree copy of the XPointer result.
996  * This will drop Attributes and Namespace declarations.
997  *
998  * Returns an xmlNodePtr list or NULL.
999  *         the caller has to free the node tree.
1000  */
1001 static xmlNodePtr
xmlXIncludeCopyXPointer(xmlXIncludeCtxtPtr ctxt,xmlXPathObjectPtr obj)1002 xmlXIncludeCopyXPointer(xmlXIncludeCtxtPtr ctxt, xmlXPathObjectPtr obj) {
1003     xmlNodePtr list = NULL, last = NULL, copy;
1004     int i;
1005 
1006     if ((ctxt == NULL) || (obj == NULL))
1007 	return(NULL);
1008     switch (obj->type) {
1009         case XPATH_NODESET: {
1010 	    xmlNodeSetPtr set = obj->nodesetval;
1011 	    if (set == NULL)
1012 		return(NULL);
1013 	    for (i = 0;i < set->nodeNr;i++) {
1014                 xmlNodePtr node;
1015 
1016 		if (set->nodeTab[i] == NULL)
1017 		    continue;
1018 		switch (set->nodeTab[i]->type) {
1019 		    case XML_DOCUMENT_NODE:
1020 		    case XML_HTML_DOCUMENT_NODE:
1021                         node = xmlDocGetRootElement(
1022                                 (xmlDocPtr) set->nodeTab[i]);
1023                         if (node == NULL) {
1024                             xmlXIncludeErr(ctxt, set->nodeTab[i],
1025                                            XML_ERR_INTERNAL_ERROR,
1026                                            "document without root\n", NULL);
1027                             continue;
1028                         }
1029                         break;
1030 		    case XML_TEXT_NODE:
1031 		    case XML_CDATA_SECTION_NODE:
1032 		    case XML_ELEMENT_NODE:
1033 		    case XML_PI_NODE:
1034 		    case XML_COMMENT_NODE:
1035                         node = set->nodeTab[i];
1036 			break;
1037                     default:
1038                         xmlXIncludeErr(ctxt, set->nodeTab[i],
1039                                        XML_XINCLUDE_XPTR_RESULT,
1040                                        "invalid node type in XPtr result\n",
1041                                        NULL);
1042 			continue; /* for */
1043 		}
1044                 /*
1045                  * OPTIMIZE TODO: External documents should already be
1046                  * expanded, so xmlDocCopyNode should work as well.
1047                  * xmlXIncludeCopyNode is only required for the initial
1048                  * document.
1049                  */
1050 		copy = xmlXIncludeCopyNode(ctxt, node, 0);
1051                 if (copy == NULL) {
1052                     xmlFreeNodeList(list);
1053                     return(NULL);
1054                 }
1055 		if (last == NULL) {
1056                     list = copy;
1057                 } else {
1058                     while (last->next != NULL)
1059                         last = last->next;
1060                     copy->prev = last;
1061                     last->next = copy;
1062 		}
1063                 last = copy;
1064 	    }
1065 	    break;
1066 	}
1067 #ifdef LIBXML_XPTR_LOCS_ENABLED
1068 	case XPATH_LOCATIONSET: {
1069 	    xmlLocationSetPtr set = (xmlLocationSetPtr) obj->user;
1070 	    if (set == NULL)
1071 		return(NULL);
1072 	    for (i = 0;i < set->locNr;i++) {
1073 		if (last == NULL)
1074 		    list = last = xmlXIncludeCopyXPointer(ctxt,
1075 			                                  set->locTab[i]);
1076 		else
1077 		    xmlAddNextSibling(last,
1078 			    xmlXIncludeCopyXPointer(ctxt, set->locTab[i]));
1079 		if (last != NULL) {
1080 		    while (last->next != NULL)
1081 			last = last->next;
1082 		}
1083 	    }
1084 	    break;
1085 	}
1086 	case XPATH_RANGE:
1087 	    return(xmlXIncludeCopyRange(ctxt, obj));
1088 	case XPATH_POINT:
1089 	    /* points are ignored in XInclude */
1090 	    break;
1091 #endif
1092 	default:
1093 	    break;
1094     }
1095     return(list);
1096 }
1097 /************************************************************************
1098  *									*
1099  *			XInclude I/O handling				*
1100  *									*
1101  ************************************************************************/
1102 
1103 typedef struct _xmlXIncludeMergeData xmlXIncludeMergeData;
1104 typedef xmlXIncludeMergeData *xmlXIncludeMergeDataPtr;
1105 struct _xmlXIncludeMergeData {
1106     xmlDocPtr doc;
1107     xmlXIncludeCtxtPtr ctxt;
1108 };
1109 
1110 /**
1111  * xmlXIncludeMergeOneEntity:
1112  * @ent: the entity
1113  * @doc:  the including doc
1114  * @name: the entity name
1115  *
1116  * Implements the merge of one entity
1117  */
1118 static void
xmlXIncludeMergeEntity(void * payload,void * vdata,const xmlChar * name ATTRIBUTE_UNUSED)1119 xmlXIncludeMergeEntity(void *payload, void *vdata,
1120 	               const xmlChar *name ATTRIBUTE_UNUSED) {
1121     xmlEntityPtr ent = (xmlEntityPtr) payload;
1122     xmlXIncludeMergeDataPtr data = (xmlXIncludeMergeDataPtr) vdata;
1123     xmlEntityPtr ret, prev;
1124     xmlDocPtr doc;
1125     xmlXIncludeCtxtPtr ctxt;
1126 
1127     if ((ent == NULL) || (data == NULL))
1128 	return;
1129     ctxt = data->ctxt;
1130     doc = data->doc;
1131     if ((ctxt == NULL) || (doc == NULL))
1132 	return;
1133     switch (ent->etype) {
1134         case XML_INTERNAL_PARAMETER_ENTITY:
1135         case XML_EXTERNAL_PARAMETER_ENTITY:
1136         case XML_INTERNAL_PREDEFINED_ENTITY:
1137 	    return;
1138         case XML_INTERNAL_GENERAL_ENTITY:
1139         case XML_EXTERNAL_GENERAL_PARSED_ENTITY:
1140         case XML_EXTERNAL_GENERAL_UNPARSED_ENTITY:
1141 	    break;
1142     }
1143     ret = xmlAddDocEntity(doc, ent->name, ent->etype, ent->ExternalID,
1144 			  ent->SystemID, ent->content);
1145     if (ret != NULL) {
1146 	if (ent->URI != NULL)
1147 	    ret->URI = xmlStrdup(ent->URI);
1148     } else {
1149 	prev = xmlGetDocEntity(doc, ent->name);
1150 	if (prev != NULL) {
1151 	    if (ent->etype != prev->etype)
1152 		goto error;
1153 
1154 	    if ((ent->SystemID != NULL) && (prev->SystemID != NULL)) {
1155 		if (!xmlStrEqual(ent->SystemID, prev->SystemID))
1156 		    goto error;
1157 	    } else if ((ent->ExternalID != NULL) &&
1158 		       (prev->ExternalID != NULL)) {
1159 		if (!xmlStrEqual(ent->ExternalID, prev->ExternalID))
1160 		    goto error;
1161 	    } else if ((ent->content != NULL) && (prev->content != NULL)) {
1162 		if (!xmlStrEqual(ent->content, prev->content))
1163 		    goto error;
1164 	    } else {
1165 		goto error;
1166 	    }
1167 
1168 	}
1169     }
1170     return;
1171 error:
1172     switch (ent->etype) {
1173         case XML_INTERNAL_PARAMETER_ENTITY:
1174         case XML_EXTERNAL_PARAMETER_ENTITY:
1175         case XML_INTERNAL_PREDEFINED_ENTITY:
1176         case XML_INTERNAL_GENERAL_ENTITY:
1177         case XML_EXTERNAL_GENERAL_PARSED_ENTITY:
1178 	    return;
1179         case XML_EXTERNAL_GENERAL_UNPARSED_ENTITY:
1180 	    break;
1181     }
1182     xmlXIncludeErr(ctxt, (xmlNodePtr) ent, XML_XINCLUDE_ENTITY_DEF_MISMATCH,
1183                    "mismatch in redefinition of entity %s\n",
1184 		   ent->name);
1185 }
1186 
1187 /**
1188  * xmlXIncludeMergeEntities:
1189  * @ctxt: an XInclude context
1190  * @doc:  the including doc
1191  * @from:  the included doc
1192  *
1193  * Implements the entity merge
1194  *
1195  * Returns 0 if merge succeeded, -1 if some processing failed
1196  */
1197 static int
xmlXIncludeMergeEntities(xmlXIncludeCtxtPtr ctxt,xmlDocPtr doc,xmlDocPtr from)1198 xmlXIncludeMergeEntities(xmlXIncludeCtxtPtr ctxt, xmlDocPtr doc,
1199 	                 xmlDocPtr from) {
1200     xmlNodePtr cur;
1201     xmlDtdPtr target, source;
1202 
1203     if (ctxt == NULL)
1204 	return(-1);
1205 
1206     if ((from == NULL) || (from->intSubset == NULL))
1207 	return(0);
1208 
1209     target = doc->intSubset;
1210     if (target == NULL) {
1211 	cur = xmlDocGetRootElement(doc);
1212 	if (cur == NULL)
1213 	    return(-1);
1214         target = xmlCreateIntSubset(doc, cur->name, NULL, NULL);
1215 	if (target == NULL)
1216 	    return(-1);
1217     }
1218 
1219     source = from->intSubset;
1220     if ((source != NULL) && (source->entities != NULL)) {
1221 	xmlXIncludeMergeData data;
1222 
1223 	data.ctxt = ctxt;
1224 	data.doc = doc;
1225 
1226 	xmlHashScan((xmlHashTablePtr) source->entities,
1227 		    xmlXIncludeMergeEntity, &data);
1228     }
1229     source = from->extSubset;
1230     if ((source != NULL) && (source->entities != NULL)) {
1231 	xmlXIncludeMergeData data;
1232 
1233 	data.ctxt = ctxt;
1234 	data.doc = doc;
1235 
1236 	/*
1237 	 * don't duplicate existing stuff when external subsets are the same
1238 	 */
1239 	if ((!xmlStrEqual(target->ExternalID, source->ExternalID)) &&
1240 	    (!xmlStrEqual(target->SystemID, source->SystemID))) {
1241 	    xmlHashScan((xmlHashTablePtr) source->entities,
1242 			xmlXIncludeMergeEntity, &data);
1243 	}
1244     }
1245     return(0);
1246 }
1247 
1248 /**
1249  * xmlXIncludeLoadDoc:
1250  * @ctxt:  the XInclude context
1251  * @url:  the associated URL
1252  * @ref:  an XMLXincludeRefPtr
1253  *
1254  * Load the document, and store the result in the XInclude context
1255  *
1256  * Returns 0 in case of success, -1 in case of failure
1257  */
1258 static int
xmlXIncludeLoadDoc(xmlXIncludeCtxtPtr ctxt,const xmlChar * url,xmlXIncludeRefPtr ref)1259 xmlXIncludeLoadDoc(xmlXIncludeCtxtPtr ctxt, const xmlChar *url,
1260                    xmlXIncludeRefPtr ref) {
1261     xmlXIncludeDocPtr cache;
1262     xmlDocPtr doc;
1263     xmlURIPtr uri;
1264     xmlChar *URL = NULL;
1265     xmlChar *fragment = NULL;
1266     int i = 0;
1267     int ret = -1;
1268 #ifdef LIBXML_XPTR_ENABLED
1269     int saveFlags;
1270 #endif
1271 
1272 #ifdef DEBUG_XINCLUDE
1273     xmlGenericError(xmlGenericErrorContext, "Loading doc %s\n", url);
1274 #endif
1275     /*
1276      * Check the URL and remove any fragment identifier
1277      */
1278     uri = xmlParseURI((const char *)url);
1279     if (uri == NULL) {
1280 	xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_HREF_URI,
1281 		       "invalid value URI %s\n", url);
1282         goto error;
1283     }
1284     if (uri->fragment != NULL) {
1285 	fragment = (xmlChar *) uri->fragment;
1286 	uri->fragment = NULL;
1287     }
1288     if (ref->fragment != NULL) {
1289 	if (fragment != NULL) xmlFree(fragment);
1290 	fragment = xmlStrdup(ref->fragment);
1291     }
1292     URL = xmlSaveUri(uri);
1293     xmlFreeURI(uri);
1294     if (URL == NULL) {
1295         xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_HREF_URI,
1296                        "invalid value URI %s\n", url);
1297         goto error;
1298     }
1299 
1300     /*
1301      * Handling of references to the local document are done
1302      * directly through ctxt->doc.
1303      */
1304     if ((URL[0] == 0) || (URL[0] == '#') ||
1305 	((ctxt->doc != NULL) && (xmlStrEqual(URL, ctxt->doc->URL)))) {
1306 	doc = ctxt->doc;
1307         goto loaded;
1308     }
1309 
1310     /*
1311      * Prevent reloading the document twice.
1312      */
1313     for (i = 0; i < ctxt->urlNr; i++) {
1314 	if (xmlStrEqual(URL, ctxt->urlTab[i].url)) {
1315 #ifdef DEBUG_XINCLUDE
1316 	    printf("Already loaded %s\n", URL);
1317 #endif
1318             if (ctxt->urlTab[i].expanding) {
1319                 xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_RECURSION,
1320                                "inclusion loop detected\n", NULL);
1321                 goto error;
1322             }
1323 	    doc = ctxt->urlTab[i].doc;
1324             if (doc == NULL)
1325                 goto error;
1326 	    goto loaded;
1327 	}
1328     }
1329 
1330     /*
1331      * Load it.
1332      */
1333 #ifdef DEBUG_XINCLUDE
1334     printf("loading %s\n", URL);
1335 #endif
1336 #ifdef LIBXML_XPTR_ENABLED
1337     /*
1338      * If this is an XPointer evaluation, we want to assure that
1339      * all entities have been resolved prior to processing the
1340      * referenced document
1341      */
1342     saveFlags = ctxt->parseFlags;
1343     if (fragment != NULL) {	/* if this is an XPointer eval */
1344 	ctxt->parseFlags |= XML_PARSE_NOENT;
1345     }
1346 #endif
1347 
1348     doc = xmlXIncludeParseFile(ctxt, (const char *)URL);
1349 #ifdef LIBXML_XPTR_ENABLED
1350     ctxt->parseFlags = saveFlags;
1351 #endif
1352 
1353     /* Also cache NULL docs */
1354     if (ctxt->urlNr >= ctxt->urlMax) {
1355         xmlXIncludeDoc *tmp;
1356         size_t newSize = ctxt->urlMax ? ctxt->urlMax * 2 : 8;
1357 
1358         tmp = xmlRealloc(ctxt->urlTab, sizeof(xmlXIncludeDoc) * newSize);
1359         if (tmp == NULL) {
1360             xmlXIncludeErrMemory(ctxt, ref->elem,
1361                                  "growing XInclude URL table");
1362             xmlFreeDoc(doc);
1363             goto error;
1364         }
1365         ctxt->urlMax = newSize;
1366         ctxt->urlTab = tmp;
1367     }
1368     cache = &ctxt->urlTab[ctxt->urlNr++];
1369     cache->doc = doc;
1370     cache->url = xmlStrdup(URL);
1371     cache->expanding = 0;
1372 
1373     if (doc == NULL)
1374         goto error;
1375     /*
1376      * It's possible that the requested URL has been mapped to a
1377      * completely different location (e.g. through a catalog entry).
1378      * To check for this, we compare the URL with that of the doc
1379      * and change it if they disagree (bug 146988).
1380      */
1381    if (!xmlStrEqual(URL, doc->URL)) {
1382        xmlFree(URL);
1383        URL = xmlStrdup(doc->URL);
1384    }
1385 
1386     /*
1387      * Make sure we have all entities fixed up
1388      */
1389     xmlXIncludeMergeEntities(ctxt, ctxt->doc, doc);
1390 
1391     /*
1392      * We don't need the DTD anymore, free up space
1393     if (doc->intSubset != NULL) {
1394 	xmlUnlinkNode((xmlNodePtr) doc->intSubset);
1395 	xmlFreeNode((xmlNodePtr) doc->intSubset);
1396 	doc->intSubset = NULL;
1397     }
1398     if (doc->extSubset != NULL) {
1399 	xmlUnlinkNode((xmlNodePtr) doc->extSubset);
1400 	xmlFreeNode((xmlNodePtr) doc->extSubset);
1401 	doc->extSubset = NULL;
1402     }
1403      */
1404     cache->expanding = 1;
1405     xmlXIncludeRecurseDoc(ctxt, doc, URL);
1406     cache->expanding = 0;
1407 
1408 loaded:
1409     if (fragment == NULL) {
1410 	/*
1411 	 * Add the top children list as the replacement copy.
1412 	 */
1413         ref->inc = xmlDocCopyNode(xmlDocGetRootElement(doc), ctxt->doc, 1);
1414     }
1415 #ifdef LIBXML_XPTR_ENABLED
1416     else {
1417 	/*
1418 	 * Computes the XPointer expression and make a copy used
1419 	 * as the replacement copy.
1420 	 */
1421 	xmlXPathObjectPtr xptr;
1422 	xmlXPathContextPtr xptrctxt;
1423 	xmlNodeSetPtr set;
1424 
1425         if (ctxt->isStream && doc == ctxt->doc) {
1426 	    xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_XPTR_FAILED,
1427 			   "XPointer expressions not allowed in streaming"
1428                            " mode\n", NULL);
1429             goto error;
1430         }
1431 
1432 	xptrctxt = xmlXPtrNewContext(doc, NULL, NULL);
1433 	if (xptrctxt == NULL) {
1434 	    xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_XPTR_FAILED,
1435 			   "could not create XPointer context\n", NULL);
1436             goto error;
1437 	}
1438 	xptr = xmlXPtrEval(fragment, xptrctxt);
1439 	if (xptr == NULL) {
1440 	    xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_XPTR_FAILED,
1441 			   "XPointer evaluation failed: #%s\n",
1442 			   fragment);
1443 	    xmlXPathFreeContext(xptrctxt);
1444             goto error;
1445 	}
1446 	switch (xptr->type) {
1447 	    case XPATH_UNDEFINED:
1448 	    case XPATH_BOOLEAN:
1449 	    case XPATH_NUMBER:
1450 	    case XPATH_STRING:
1451 #ifdef LIBXML_XPTR_LOCS_ENABLED
1452 	    case XPATH_POINT:
1453 #endif
1454 	    case XPATH_USERS:
1455 	    case XPATH_XSLT_TREE:
1456 		xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_XPTR_RESULT,
1457 			       "XPointer is not a range: #%s\n",
1458 			       fragment);
1459                 xmlXPathFreeObject(xptr);
1460 		xmlXPathFreeContext(xptrctxt);
1461                 goto error;
1462 	    case XPATH_NODESET:
1463 	        if ((xptr->nodesetval == NULL) ||
1464 		    (xptr->nodesetval->nodeNr <= 0)) {
1465                     xmlXPathFreeObject(xptr);
1466 		    xmlXPathFreeContext(xptrctxt);
1467                     goto error;
1468 		}
1469 
1470 #ifdef LIBXML_XPTR_LOCS_ENABLED
1471 	    case XPATH_RANGE:
1472 	    case XPATH_LOCATIONSET:
1473 		break;
1474 #endif
1475 	}
1476 	set = xptr->nodesetval;
1477 	if (set != NULL) {
1478 	    for (i = 0;i < set->nodeNr;i++) {
1479 		if (set->nodeTab[i] == NULL)
1480 		    continue;
1481 		switch (set->nodeTab[i]->type) {
1482 		    case XML_ELEMENT_NODE:
1483 		    case XML_TEXT_NODE:
1484 		    case XML_CDATA_SECTION_NODE:
1485 		    case XML_ENTITY_REF_NODE:
1486 		    case XML_ENTITY_NODE:
1487 		    case XML_PI_NODE:
1488 		    case XML_COMMENT_NODE:
1489 		    case XML_DOCUMENT_NODE:
1490 		    case XML_HTML_DOCUMENT_NODE:
1491 			continue;
1492 
1493 		    case XML_ATTRIBUTE_NODE:
1494 			xmlXIncludeErr(ctxt, ref->elem,
1495 			               XML_XINCLUDE_XPTR_RESULT,
1496 				       "XPointer selects an attribute: #%s\n",
1497 				       fragment);
1498 			set->nodeTab[i] = NULL;
1499 			continue;
1500 		    case XML_NAMESPACE_DECL:
1501 			xmlXIncludeErr(ctxt, ref->elem,
1502 			               XML_XINCLUDE_XPTR_RESULT,
1503 				       "XPointer selects a namespace: #%s\n",
1504 				       fragment);
1505 			set->nodeTab[i] = NULL;
1506 			continue;
1507 		    case XML_DOCUMENT_TYPE_NODE:
1508 		    case XML_DOCUMENT_FRAG_NODE:
1509 		    case XML_NOTATION_NODE:
1510 		    case XML_DTD_NODE:
1511 		    case XML_ELEMENT_DECL:
1512 		    case XML_ATTRIBUTE_DECL:
1513 		    case XML_ENTITY_DECL:
1514 		    case XML_XINCLUDE_START:
1515 		    case XML_XINCLUDE_END:
1516 			xmlXIncludeErr(ctxt, ref->elem,
1517 			               XML_XINCLUDE_XPTR_RESULT,
1518 				   "XPointer selects unexpected nodes: #%s\n",
1519 				       fragment);
1520 			set->nodeTab[i] = NULL;
1521 			set->nodeTab[i] = NULL;
1522 			continue; /* for */
1523 		}
1524 	    }
1525 	}
1526         ref->inc = xmlXIncludeCopyXPointer(ctxt, xptr);
1527         xmlXPathFreeObject(xptr);
1528 	xmlXPathFreeContext(xptrctxt);
1529     }
1530 #endif
1531 
1532     /*
1533      * Do the xml:base fixup if needed
1534      */
1535     if ((doc != NULL) && (URL != NULL) &&
1536         (!(ctxt->parseFlags & XML_PARSE_NOBASEFIX)) &&
1537 	(!(doc->parseFlags & XML_PARSE_NOBASEFIX))) {
1538 	xmlNodePtr node;
1539 	xmlChar *base;
1540 	xmlChar *curBase;
1541 
1542 	/*
1543 	 * The base is only adjusted if "necessary", i.e. if the xinclude node
1544 	 * has a base specified, or the URL is relative
1545 	 */
1546 	base = xmlGetNsProp(ref->elem, BAD_CAST "base", XML_XML_NAMESPACE);
1547 	if (base == NULL) {
1548 	    /*
1549 	     * No xml:base on the xinclude node, so we check whether the
1550 	     * URI base is different than (relative to) the context base
1551 	     */
1552 	    curBase = xmlBuildRelativeURI(URL, ctxt->base);
1553 	    if (curBase == NULL) {	/* Error return */
1554 	        xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_HREF_URI,
1555 		       "trying to build relative URI from %s\n", URL);
1556 	    } else {
1557 		/* If the URI doesn't contain a slash, it's not relative */
1558 	        if (!xmlStrchr(curBase, '/'))
1559 		    xmlFree(curBase);
1560 		else
1561 		    base = curBase;
1562 	    }
1563 	}
1564 	if (base != NULL) {	/* Adjustment may be needed */
1565 	    node = ref->inc;
1566 	    while (node != NULL) {
1567 		/* Only work on element nodes */
1568 		if (node->type == XML_ELEMENT_NODE) {
1569 		    curBase = xmlNodeGetBase(node->doc, node);
1570 		    /* If no current base, set it */
1571 		    if (curBase == NULL) {
1572 			xmlNodeSetBase(node, base);
1573 		    } else {
1574 			/*
1575 			 * If the current base is the same as the
1576 			 * URL of the document, then reset it to be
1577 			 * the specified xml:base or the relative URI
1578 			 */
1579 			if (xmlStrEqual(curBase, node->doc->URL)) {
1580 			    xmlNodeSetBase(node, base);
1581 			} else {
1582 			    /*
1583 			     * If the element already has an xml:base
1584 			     * set, then relativise it if necessary
1585 			     */
1586 			    xmlChar *xmlBase;
1587 			    xmlBase = xmlGetNsProp(node,
1588 					    BAD_CAST "base",
1589 					    XML_XML_NAMESPACE);
1590 			    if (xmlBase != NULL) {
1591 				xmlChar *relBase;
1592 				relBase = xmlBuildURI(xmlBase, base);
1593 				if (relBase == NULL) { /* error */
1594 				    xmlXIncludeErr(ctxt,
1595 						ref->elem,
1596 						XML_XINCLUDE_HREF_URI,
1597 					"trying to rebuild base from %s\n",
1598 						xmlBase);
1599 				} else {
1600 				    xmlNodeSetBase(node, relBase);
1601 				    xmlFree(relBase);
1602 				}
1603 				xmlFree(xmlBase);
1604 			    }
1605 			}
1606 			xmlFree(curBase);
1607 		    }
1608 		}
1609 	        node = node->next;
1610 	    }
1611 	    xmlFree(base);
1612 	}
1613     }
1614     ret = 0;
1615 
1616 error:
1617     xmlFree(URL);
1618     xmlFree(fragment);
1619     return(ret);
1620 }
1621 
1622 /**
1623  * xmlXIncludeLoadTxt:
1624  * @ctxt:  the XInclude context
1625  * @url:  the associated URL
1626  * @ref:  an XMLXincludeRefPtr
1627  *
1628  * Load the content, and store the result in the XInclude context
1629  *
1630  * Returns 0 in case of success, -1 in case of failure
1631  */
1632 static int
xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt,const xmlChar * url,xmlXIncludeRefPtr ref)1633 xmlXIncludeLoadTxt(xmlXIncludeCtxtPtr ctxt, const xmlChar *url,
1634                    xmlXIncludeRefPtr ref) {
1635     xmlParserInputBufferPtr buf;
1636     xmlNodePtr node = NULL;
1637     xmlURIPtr uri = NULL;
1638     xmlChar *URL = NULL;
1639     int i;
1640     int ret = -1;
1641     xmlChar *encoding = NULL;
1642     xmlCharEncoding enc = (xmlCharEncoding) 0;
1643     xmlParserCtxtPtr pctxt = NULL;
1644     xmlParserInputPtr inputStream = NULL;
1645     int len;
1646     const xmlChar *content;
1647 
1648 
1649     /* Don't read from stdin. */
1650     if (xmlStrcmp(url, BAD_CAST "-") == 0)
1651         url = BAD_CAST "./-";
1652 
1653     /*
1654      * Check the URL and remove any fragment identifier
1655      */
1656     uri = xmlParseURI((const char *)url);
1657     if (uri == NULL) {
1658 	xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_HREF_URI,
1659 	               "invalid value URI %s\n", url);
1660 	goto error;
1661     }
1662     if (uri->fragment != NULL) {
1663 	xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_TEXT_FRAGMENT,
1664 	               "fragment identifier forbidden for text: %s\n",
1665 		       (const xmlChar *) uri->fragment);
1666 	goto error;
1667     }
1668     URL = xmlSaveUri(uri);
1669     if (URL == NULL) {
1670 	xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_HREF_URI,
1671 	               "invalid value URI %s\n", url);
1672 	goto error;
1673     }
1674 
1675     /*
1676      * Handling of references to the local document are done
1677      * directly through ctxt->doc.
1678      */
1679     if (URL[0] == 0) {
1680 	xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_TEXT_DOCUMENT,
1681 		       "text serialization of document not available\n", NULL);
1682 	goto error;
1683     }
1684 
1685     /*
1686      * Prevent reloading the document twice.
1687      */
1688     for (i = 0; i < ctxt->txtNr; i++) {
1689 	if (xmlStrEqual(URL, ctxt->txtTab[i].url)) {
1690             node = xmlNewDocText(ctxt->doc, ctxt->txtTab[i].text);
1691 	    goto loaded;
1692 	}
1693     }
1694 
1695     /*
1696      * Try to get the encoding if available
1697      */
1698     if (ref->elem != NULL) {
1699 	encoding = xmlGetProp(ref->elem, XINCLUDE_PARSE_ENCODING);
1700     }
1701     if (encoding != NULL) {
1702 	/*
1703 	 * TODO: we should not have to remap to the xmlCharEncoding
1704 	 *       predefined set, a better interface than
1705 	 *       xmlParserInputBufferCreateFilename should allow any
1706 	 *       encoding supported by iconv
1707 	 */
1708         enc = xmlParseCharEncoding((const char *) encoding);
1709 	if (enc == XML_CHAR_ENCODING_ERROR) {
1710 	    xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_UNKNOWN_ENCODING,
1711 			   "encoding %s not supported\n", encoding);
1712 	    goto error;
1713 	}
1714     }
1715 
1716     /*
1717      * Load it.
1718      */
1719     pctxt = xmlNewParserCtxt();
1720     inputStream = xmlLoadExternalEntity((const char*)URL, NULL, pctxt);
1721     if(inputStream == NULL)
1722 	goto error;
1723     buf = inputStream->buf;
1724     if (buf == NULL)
1725 	goto error;
1726     if (buf->encoder)
1727 	xmlCharEncCloseFunc(buf->encoder);
1728     buf->encoder = xmlGetCharEncodingHandler(enc);
1729     node = xmlNewDocText(ctxt->doc, NULL);
1730     if (node == NULL) {
1731         xmlXIncludeErrMemory(ctxt, ref->elem, NULL);
1732 	goto error;
1733     }
1734 
1735     /*
1736      * Scan all chars from the resource and add the to the node
1737      */
1738     while (xmlParserInputBufferRead(buf, 4096) > 0)
1739         ;
1740 
1741     content = xmlBufContent(buf->buffer);
1742     len = xmlBufLength(buf->buffer);
1743     for (i = 0; i < len;) {
1744         int cur;
1745         int l;
1746 
1747         cur = xmlStringCurrentChar(NULL, &content[i], &l);
1748         if (!IS_CHAR(cur)) {
1749             xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_INVALID_CHAR,
1750                            "%s contains invalid char\n", URL);
1751             goto error;
1752         }
1753 
1754         i += l;
1755     }
1756 
1757     xmlNodeAddContentLen(node, content, len);
1758 
1759     if (ctxt->txtNr >= ctxt->txtMax) {
1760         xmlXIncludeTxt *tmp;
1761         size_t newSize = ctxt->txtMax ? ctxt->txtMax * 2 : 8;
1762 
1763         tmp = xmlRealloc(ctxt->txtTab, sizeof(xmlXIncludeTxt) * newSize);
1764         if (tmp == NULL) {
1765             xmlXIncludeErrMemory(ctxt, ref->elem,
1766                                  "growing XInclude text table");
1767 	    goto error;
1768         }
1769         ctxt->txtMax = newSize;
1770         ctxt->txtTab = tmp;
1771     }
1772     ctxt->txtTab[ctxt->txtNr].text = xmlStrdup(node->content);
1773     ctxt->txtTab[ctxt->txtNr].url = xmlStrdup(URL);
1774     ctxt->txtNr++;
1775 
1776 loaded:
1777     /*
1778      * Add the element as the replacement copy.
1779      */
1780     ref->inc = node;
1781     node = NULL;
1782     ret = 0;
1783 
1784 error:
1785     xmlFreeNode(node);
1786     xmlFreeInputStream(inputStream);
1787     xmlFreeParserCtxt(pctxt);
1788     xmlFree(encoding);
1789     xmlFreeURI(uri);
1790     xmlFree(URL);
1791     return(ret);
1792 }
1793 
1794 /**
1795  * xmlXIncludeLoadFallback:
1796  * @ctxt:  the XInclude context
1797  * @fallback:  the fallback node
1798  * @ref:  an XMLXincludeRefPtr
1799  *
1800  * Load the content of the fallback node, and store the result
1801  * in the XInclude context
1802  *
1803  * Returns 0 in case of success, -1 in case of failure
1804  */
1805 static int
xmlXIncludeLoadFallback(xmlXIncludeCtxtPtr ctxt,xmlNodePtr fallback,xmlXIncludeRefPtr ref)1806 xmlXIncludeLoadFallback(xmlXIncludeCtxtPtr ctxt, xmlNodePtr fallback,
1807                         xmlXIncludeRefPtr ref) {
1808     int ret = 0;
1809     int oldNbErrors;
1810 
1811     if ((fallback == NULL) || (fallback->type == XML_NAMESPACE_DECL) ||
1812         (ctxt == NULL))
1813 	return(-1);
1814     if (fallback->children != NULL) {
1815 	/*
1816 	 * It's possible that the fallback also has 'includes'
1817 	 * (Bug 129969), so we re-process the fallback just in case
1818 	 */
1819         oldNbErrors = ctxt->nbErrors;
1820 	ref->inc = xmlXIncludeCopyNode(ctxt, fallback, 1);
1821 	if (ctxt->nbErrors > oldNbErrors)
1822 	    ret = -1;
1823         else if (ref->inc == NULL)
1824             ref->emptyFb = 1;
1825     } else {
1826         ref->inc = NULL;
1827 	ref->emptyFb = 1;	/* flag empty callback */
1828     }
1829     ref->fallback = 1;
1830     return(ret);
1831 }
1832 
1833 /************************************************************************
1834  *									*
1835  *			XInclude Processing				*
1836  *									*
1837  ************************************************************************/
1838 
1839 /**
1840  * xmlXIncludeExpandNode:
1841  * @ctxt: an XInclude context
1842  * @node: an XInclude node
1843  *
1844  * If the XInclude node wasn't processed yet, create a new RefPtr,
1845  * add it to ctxt->incTab and load the included items.
1846  *
1847  * Returns the new or existing xmlXIncludeRefPtr, or NULL in case of error.
1848  */
1849 static xmlXIncludeRefPtr
xmlXIncludeExpandNode(xmlXIncludeCtxtPtr ctxt,xmlNodePtr node)1850 xmlXIncludeExpandNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node) {
1851     xmlXIncludeRefPtr ref;
1852     int i;
1853 
1854     if (ctxt->fatalErr)
1855         return(NULL);
1856     if (ctxt->depth >= XINCLUDE_MAX_DEPTH) {
1857         xmlXIncludeErr(ctxt, node, XML_XINCLUDE_RECURSION,
1858                        "maximum recursion depth exceeded\n", NULL);
1859         ctxt->fatalErr = 1;
1860         return(NULL);
1861     }
1862 
1863 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1864     /*
1865      * The XInclude engine offers no protection against exponential
1866      * expansion attacks similar to "billion laughs". Avoid timeouts by
1867      * limiting the total number of replacements when fuzzing.
1868      */
1869     if (ctxt->incTotal >= 20)
1870         return(NULL);
1871     ctxt->incTotal++;
1872 #endif
1873 
1874     for (i = 0; i < ctxt->incNr; i++) {
1875         if (ctxt->incTab[i]->elem == node) {
1876             if (ctxt->incTab[i]->expanding) {
1877                 xmlXIncludeErr(ctxt, node, XML_XINCLUDE_RECURSION,
1878                                "inclusion loop detected\n", NULL);
1879                 return(NULL);
1880             }
1881             return(ctxt->incTab[i]);
1882         }
1883     }
1884 
1885     ref = xmlXIncludeAddNode(ctxt, node);
1886     if (ref == NULL)
1887         return(NULL);
1888     ref->expanding = 1;
1889     ctxt->depth++;
1890     xmlXIncludeLoadNode(ctxt, ref);
1891     ctxt->depth--;
1892     ref->expanding = 0;
1893 
1894     return(ref);
1895 }
1896 
1897 /**
1898  * xmlXIncludeLoadNode:
1899  * @ctxt: an XInclude context
1900  * @ref: an xmlXIncludeRefPtr
1901  *
1902  * Find and load the infoset replacement for the given node.
1903  *
1904  * Returns 0 if substitution succeeded, -1 if some processing failed
1905  */
1906 static int
xmlXIncludeLoadNode(xmlXIncludeCtxtPtr ctxt,xmlXIncludeRefPtr ref)1907 xmlXIncludeLoadNode(xmlXIncludeCtxtPtr ctxt, xmlXIncludeRefPtr ref) {
1908     xmlNodePtr cur;
1909     xmlChar *href;
1910     xmlChar *parse;
1911     xmlChar *base;
1912     xmlChar *oldBase;
1913     xmlChar *URI;
1914     int xml = 1; /* default Issue 64 */
1915     int ret;
1916 
1917     if ((ctxt == NULL) || (ref == NULL))
1918 	return(-1);
1919     cur = ref->elem;
1920     if (cur == NULL)
1921 	return(-1);
1922 
1923     /*
1924      * read the attributes
1925      */
1926     href = xmlXIncludeGetProp(ctxt, cur, XINCLUDE_HREF);
1927     if (href == NULL) {
1928 	href = xmlStrdup(BAD_CAST ""); /* @@@@ href is now optional */
1929 	if (href == NULL)
1930 	    return(-1);
1931     }
1932     parse = xmlXIncludeGetProp(ctxt, cur, XINCLUDE_PARSE);
1933     if (parse != NULL) {
1934 	if (xmlStrEqual(parse, XINCLUDE_PARSE_XML))
1935 	    xml = 1;
1936 	else if (xmlStrEqual(parse, XINCLUDE_PARSE_TEXT))
1937 	    xml = 0;
1938 	else {
1939 	    xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_PARSE_VALUE,
1940 			   "invalid value %s for 'parse'\n", parse);
1941 	    if (href != NULL)
1942 		xmlFree(href);
1943 	    if (parse != NULL)
1944 		xmlFree(parse);
1945 	    return(-1);
1946 	}
1947     }
1948 
1949     /*
1950      * compute the URI
1951      */
1952     base = xmlNodeGetBase(ctxt->doc, cur);
1953     if (base == NULL) {
1954 	URI = xmlBuildURI(href, ctxt->doc->URL);
1955     } else {
1956 	URI = xmlBuildURI(href, base);
1957     }
1958     if (URI == NULL) {
1959 	xmlChar *escbase;
1960 	xmlChar *eschref;
1961 	/*
1962 	 * Some escaping may be needed
1963 	 */
1964 	escbase = xmlURIEscape(base);
1965 	eschref = xmlURIEscape(href);
1966 	URI = xmlBuildURI(eschref, escbase);
1967 	if (escbase != NULL)
1968 	    xmlFree(escbase);
1969 	if (eschref != NULL)
1970 	    xmlFree(eschref);
1971     }
1972     if (URI == NULL) {
1973 	xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_HREF_URI,
1974                        "failed build URL\n", NULL);
1975 	if (parse != NULL)
1976 	    xmlFree(parse);
1977 	if (href != NULL)
1978 	    xmlFree(href);
1979 	if (base != NULL)
1980 	    xmlFree(base);
1981 	return(-1);
1982     }
1983 #ifdef DEBUG_XINCLUDE
1984     xmlGenericError(xmlGenericErrorContext, "parse: %s\n",
1985 	    xml ? "xml": "text");
1986     xmlGenericError(xmlGenericErrorContext, "URI: %s\n", URI);
1987 #endif
1988 
1989     /*
1990      * Save the base for this include (saving the current one)
1991      */
1992     oldBase = ctxt->base;
1993     ctxt->base = base;
1994 
1995     if (xml) {
1996 	ret = xmlXIncludeLoadDoc(ctxt, URI, ref);
1997 	/* xmlXIncludeGetFragment(ctxt, cur, URI); */
1998     } else {
1999 	ret = xmlXIncludeLoadTxt(ctxt, URI, ref);
2000     }
2001 
2002     /*
2003      * Restore the original base before checking for fallback
2004      */
2005     ctxt->base = oldBase;
2006 
2007     if (ret < 0) {
2008 	xmlNodePtr children;
2009 
2010 	/*
2011 	 * Time to try a fallback if available
2012 	 */
2013 #ifdef DEBUG_XINCLUDE
2014 	xmlGenericError(xmlGenericErrorContext, "error looking for fallback\n");
2015 #endif
2016 	children = cur->children;
2017 	while (children != NULL) {
2018 	    if ((children->type == XML_ELEMENT_NODE) &&
2019 		(children->ns != NULL) &&
2020 		(xmlStrEqual(children->name, XINCLUDE_FALLBACK)) &&
2021 		((xmlStrEqual(children->ns->href, XINCLUDE_NS)) ||
2022 		 (xmlStrEqual(children->ns->href, XINCLUDE_OLD_NS)))) {
2023 		ret = xmlXIncludeLoadFallback(ctxt, children, ref);
2024 		break;
2025 	    }
2026 	    children = children->next;
2027 	}
2028     }
2029     if (ret < 0) {
2030 	xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_NO_FALLBACK,
2031 		       "could not load %s, and no fallback was found\n",
2032 		       URI);
2033     }
2034 
2035     /*
2036      * Cleanup
2037      */
2038     if (URI != NULL)
2039 	xmlFree(URI);
2040     if (parse != NULL)
2041 	xmlFree(parse);
2042     if (href != NULL)
2043 	xmlFree(href);
2044     if (base != NULL)
2045 	xmlFree(base);
2046     return(0);
2047 }
2048 
2049 /**
2050  * xmlXIncludeIncludeNode:
2051  * @ctxt: an XInclude context
2052  * @ref: an xmlXIncludeRefPtr
2053  *
2054  * Implement the infoset replacement for the given node
2055  *
2056  * Returns 0 if substitution succeeded, -1 if some processing failed
2057  */
2058 static int
xmlXIncludeIncludeNode(xmlXIncludeCtxtPtr ctxt,xmlXIncludeRefPtr ref)2059 xmlXIncludeIncludeNode(xmlXIncludeCtxtPtr ctxt, xmlXIncludeRefPtr ref) {
2060     xmlNodePtr cur, end, list, tmp;
2061 
2062     if ((ctxt == NULL) || (ref == NULL))
2063 	return(-1);
2064     cur = ref->elem;
2065     if ((cur == NULL) || (cur->type == XML_NAMESPACE_DECL))
2066 	return(-1);
2067 
2068     list = ref->inc;
2069     ref->inc = NULL;
2070     ref->emptyFb = 0;
2071 
2072     /*
2073      * Check against the risk of generating a multi-rooted document
2074      */
2075     if ((cur->parent != NULL) &&
2076 	(cur->parent->type != XML_ELEMENT_NODE)) {
2077 	int nb_elem = 0;
2078 
2079 	tmp = list;
2080 	while (tmp != NULL) {
2081 	    if (tmp->type == XML_ELEMENT_NODE)
2082 		nb_elem++;
2083 	    tmp = tmp->next;
2084 	}
2085 	if (nb_elem > 1) {
2086 	    xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_MULTIPLE_ROOT,
2087 		       "XInclude error: would result in multiple root nodes\n",
2088 			   NULL);
2089             xmlFreeNodeList(list);
2090 	    return(-1);
2091 	}
2092     }
2093 
2094     if (ctxt->parseFlags & XML_PARSE_NOXINCNODE) {
2095 	/*
2096 	 * Add the list of nodes
2097 	 */
2098 	while (list != NULL) {
2099 	    end = list;
2100 	    list = list->next;
2101 
2102 	    xmlAddPrevSibling(cur, end);
2103 	}
2104         /*
2105          * FIXME: xmlUnlinkNode doesn't coalesce text nodes.
2106          */
2107 	xmlUnlinkNode(cur);
2108 	xmlFreeNode(cur);
2109     } else {
2110         xmlNodePtr child, next;
2111 
2112 	/*
2113 	 * Change the current node as an XInclude start one, and add an
2114 	 * XInclude end one
2115 	 */
2116         if (ref->fallback)
2117             xmlUnsetProp(cur, BAD_CAST "href");
2118 	cur->type = XML_XINCLUDE_START;
2119         /* Remove fallback children */
2120         for (child = cur->children; child != NULL; child = next) {
2121             next = child->next;
2122             xmlUnlinkNode(child);
2123             xmlFreeNode(child);
2124         }
2125 	end = xmlNewDocNode(cur->doc, cur->ns, cur->name, NULL);
2126 	if (end == NULL) {
2127 	    xmlXIncludeErr(ctxt, ref->elem, XML_XINCLUDE_BUILD_FAILED,
2128 			   "failed to build node\n", NULL);
2129             xmlFreeNodeList(list);
2130 	    return(-1);
2131 	}
2132 	end->type = XML_XINCLUDE_END;
2133 	xmlAddNextSibling(cur, end);
2134 
2135 	/*
2136 	 * Add the list of nodes
2137 	 */
2138 	while (list != NULL) {
2139 	    cur = list;
2140 	    list = list->next;
2141 
2142 	    xmlAddPrevSibling(end, cur);
2143 	}
2144     }
2145 
2146 
2147     return(0);
2148 }
2149 
2150 /**
2151  * xmlXIncludeTestNode:
2152  * @ctxt: the XInclude processing context
2153  * @node: an XInclude node
2154  *
2155  * test if the node is an XInclude node
2156  *
2157  * Returns 1 true, 0 otherwise
2158  */
2159 static int
xmlXIncludeTestNode(xmlXIncludeCtxtPtr ctxt,xmlNodePtr node)2160 xmlXIncludeTestNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node) {
2161     if (node == NULL)
2162 	return(0);
2163     if (node->type != XML_ELEMENT_NODE)
2164 	return(0);
2165     if (node->ns == NULL)
2166 	return(0);
2167     if ((xmlStrEqual(node->ns->href, XINCLUDE_NS)) ||
2168         (xmlStrEqual(node->ns->href, XINCLUDE_OLD_NS))) {
2169 	if (xmlStrEqual(node->ns->href, XINCLUDE_OLD_NS)) {
2170 	    if (ctxt->legacy == 0) {
2171 #if 0 /* wait for the XML Core Working Group to get something stable ! */
2172 		xmlXIncludeWarn(ctxt, node, XML_XINCLUDE_DEPRECATED_NS,
2173 	               "Deprecated XInclude namespace found, use %s",
2174 		                XINCLUDE_NS);
2175 #endif
2176 	        ctxt->legacy = 1;
2177 	    }
2178 	}
2179 	if (xmlStrEqual(node->name, XINCLUDE_NODE)) {
2180 	    xmlNodePtr child = node->children;
2181 	    int nb_fallback = 0;
2182 
2183 	    while (child != NULL) {
2184 		if ((child->type == XML_ELEMENT_NODE) &&
2185 		    (child->ns != NULL) &&
2186 		    ((xmlStrEqual(child->ns->href, XINCLUDE_NS)) ||
2187 		     (xmlStrEqual(child->ns->href, XINCLUDE_OLD_NS)))) {
2188 		    if (xmlStrEqual(child->name, XINCLUDE_NODE)) {
2189 			xmlXIncludeErr(ctxt, node,
2190 			               XML_XINCLUDE_INCLUDE_IN_INCLUDE,
2191 				       "%s has an 'include' child\n",
2192 				       XINCLUDE_NODE);
2193 			return(0);
2194 		    }
2195 		    if (xmlStrEqual(child->name, XINCLUDE_FALLBACK)) {
2196 			nb_fallback++;
2197 		    }
2198 		}
2199 		child = child->next;
2200 	    }
2201 	    if (nb_fallback > 1) {
2202 		xmlXIncludeErr(ctxt, node, XML_XINCLUDE_FALLBACKS_IN_INCLUDE,
2203 			       "%s has multiple fallback children\n",
2204 		               XINCLUDE_NODE);
2205 		return(0);
2206 	    }
2207 	    return(1);
2208 	}
2209 	if (xmlStrEqual(node->name, XINCLUDE_FALLBACK)) {
2210 	    if ((node->parent == NULL) ||
2211 		(node->parent->type != XML_ELEMENT_NODE) ||
2212 		(node->parent->ns == NULL) ||
2213 		((!xmlStrEqual(node->parent->ns->href, XINCLUDE_NS)) &&
2214 		 (!xmlStrEqual(node->parent->ns->href, XINCLUDE_OLD_NS))) ||
2215 		(!xmlStrEqual(node->parent->name, XINCLUDE_NODE))) {
2216 		xmlXIncludeErr(ctxt, node,
2217 		               XML_XINCLUDE_FALLBACK_NOT_IN_INCLUDE,
2218 			       "%s is not the child of an 'include'\n",
2219 			       XINCLUDE_FALLBACK);
2220 	    }
2221 	}
2222     }
2223     return(0);
2224 }
2225 
2226 /**
2227  * xmlXIncludeDoProcess:
2228  * @ctxt: the XInclude processing context
2229  * @tree: the top of the tree to process
2230  *
2231  * Implement the XInclude substitution on the XML document @doc
2232  *
2233  * Returns 0 if no substitution were done, -1 if some processing failed
2234  *    or the number of substitutions done.
2235  */
2236 static int
xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt,xmlNodePtr tree)2237 xmlXIncludeDoProcess(xmlXIncludeCtxtPtr ctxt, xmlNodePtr tree) {
2238     xmlXIncludeRefPtr ref;
2239     xmlNodePtr cur;
2240     int ret = 0;
2241     int i, start;
2242 
2243     if ((tree == NULL) || (tree->type == XML_NAMESPACE_DECL))
2244 	return(-1);
2245     if (ctxt == NULL)
2246 	return(-1);
2247 
2248     /*
2249      * First phase: lookup the elements in the document
2250      */
2251     start = ctxt->incNr;
2252     cur = tree;
2253     do {
2254 	/* TODO: need to work on entities -> stack */
2255         if (xmlXIncludeTestNode(ctxt, cur) == 1) {
2256             ref = xmlXIncludeExpandNode(ctxt, cur);
2257             /*
2258              * Mark direct includes.
2259              */
2260             if (ref != NULL)
2261                 ref->replace = 1;
2262         } else if ((cur->children != NULL) &&
2263                    ((cur->type == XML_DOCUMENT_NODE) ||
2264                     (cur->type == XML_ELEMENT_NODE))) {
2265             cur = cur->children;
2266             continue;
2267         }
2268         do {
2269             if (cur == tree)
2270                 break;
2271             if (cur->next != NULL) {
2272                 cur = cur->next;
2273                 break;
2274             }
2275             cur = cur->parent;
2276         } while (cur != NULL);
2277     } while ((cur != NULL) && (cur != tree));
2278 
2279     /*
2280      * Second phase: extend the original document infoset.
2281      */
2282     for (i = start; i < ctxt->incNr; i++) {
2283 	if (ctxt->incTab[i]->replace != 0) {
2284             if ((ctxt->incTab[i]->inc != NULL) ||
2285                 (ctxt->incTab[i]->emptyFb != 0)) {	/* (empty fallback) */
2286                 xmlXIncludeIncludeNode(ctxt, ctxt->incTab[i]);
2287             }
2288             ctxt->incTab[i]->replace = 0;
2289         } else {
2290             /*
2291              * Ignore includes which were added indirectly, for example
2292              * inside xi:fallback elements.
2293              */
2294             if (ctxt->incTab[i]->inc != NULL) {
2295                 xmlFreeNodeList(ctxt->incTab[i]->inc);
2296                 ctxt->incTab[i]->inc = NULL;
2297             }
2298         }
2299 	ret++;
2300     }
2301 
2302     if (ctxt->isStream) {
2303         /*
2304          * incTab references nodes which will eventually be deleted in
2305          * streaming mode. The table is only required for XPointer
2306          * expressions which aren't allowed in streaming mode.
2307          */
2308         for (i = 0;i < ctxt->incNr;i++) {
2309             xmlXIncludeFreeRef(ctxt->incTab[i]);
2310         }
2311         ctxt->incNr = 0;
2312     }
2313 
2314     return(ret);
2315 }
2316 
2317 /**
2318  * xmlXIncludeSetFlags:
2319  * @ctxt:  an XInclude processing context
2320  * @flags: a set of xmlParserOption used for parsing XML includes
2321  *
2322  * Set the flags used for further processing of XML resources.
2323  *
2324  * Returns 0 in case of success and -1 in case of error.
2325  */
2326 int
xmlXIncludeSetFlags(xmlXIncludeCtxtPtr ctxt,int flags)2327 xmlXIncludeSetFlags(xmlXIncludeCtxtPtr ctxt, int flags) {
2328     if (ctxt == NULL)
2329         return(-1);
2330     ctxt->parseFlags = flags;
2331     return(0);
2332 }
2333 
2334 /**
2335  * xmlXIncludeSetStreamingMode:
2336  * @ctxt:  an XInclude processing context
2337  * @mode:  whether streaming mode should be enabled
2338  *
2339  * In streaming mode, XPointer expressions aren't allowed.
2340  *
2341  * Returns 0 in case of success and -1 in case of error.
2342  */
2343 int
xmlXIncludeSetStreamingMode(xmlXIncludeCtxtPtr ctxt,int mode)2344 xmlXIncludeSetStreamingMode(xmlXIncludeCtxtPtr ctxt, int mode) {
2345     if (ctxt == NULL)
2346         return(-1);
2347     ctxt->isStream = !!mode;
2348     return(0);
2349 }
2350 
2351 /**
2352  * xmlXIncludeProcessTreeFlagsData:
2353  * @tree: an XML node
2354  * @flags: a set of xmlParserOption used for parsing XML includes
2355  * @data: application data that will be passed to the parser context
2356  *        in the _private field of the parser context(s)
2357  *
2358  * Implement the XInclude substitution on the XML node @tree
2359  *
2360  * Returns 0 if no substitution were done, -1 if some processing failed
2361  *    or the number of substitutions done.
2362  */
2363 
2364 int
xmlXIncludeProcessTreeFlagsData(xmlNodePtr tree,int flags,void * data)2365 xmlXIncludeProcessTreeFlagsData(xmlNodePtr tree, int flags, void *data) {
2366     xmlXIncludeCtxtPtr ctxt;
2367     int ret = 0;
2368 
2369     if ((tree == NULL) || (tree->type == XML_NAMESPACE_DECL) ||
2370         (tree->doc == NULL))
2371         return(-1);
2372 
2373     ctxt = xmlXIncludeNewContext(tree->doc);
2374     if (ctxt == NULL)
2375         return(-1);
2376     ctxt->_private = data;
2377     ctxt->base = xmlStrdup((xmlChar *)tree->doc->URL);
2378     xmlXIncludeSetFlags(ctxt, flags);
2379     ret = xmlXIncludeDoProcess(ctxt, tree);
2380     if ((ret >= 0) && (ctxt->nbErrors > 0))
2381         ret = -1;
2382 
2383     xmlXIncludeFreeContext(ctxt);
2384     return(ret);
2385 }
2386 
2387 /**
2388  * xmlXIncludeProcessFlagsData:
2389  * @doc: an XML document
2390  * @flags: a set of xmlParserOption used for parsing XML includes
2391  * @data: application data that will be passed to the parser context
2392  *        in the _private field of the parser context(s)
2393  *
2394  * Implement the XInclude substitution on the XML document @doc
2395  *
2396  * Returns 0 if no substitution were done, -1 if some processing failed
2397  *    or the number of substitutions done.
2398  */
2399 int
xmlXIncludeProcessFlagsData(xmlDocPtr doc,int flags,void * data)2400 xmlXIncludeProcessFlagsData(xmlDocPtr doc, int flags, void *data) {
2401     xmlNodePtr tree;
2402 
2403     if (doc == NULL)
2404 	return(-1);
2405     tree = xmlDocGetRootElement(doc);
2406     if (tree == NULL)
2407 	return(-1);
2408     return(xmlXIncludeProcessTreeFlagsData(tree, flags, data));
2409 }
2410 
2411 /**
2412  * xmlXIncludeProcessFlags:
2413  * @doc: an XML document
2414  * @flags: a set of xmlParserOption used for parsing XML includes
2415  *
2416  * Implement the XInclude substitution on the XML document @doc
2417  *
2418  * Returns 0 if no substitution were done, -1 if some processing failed
2419  *    or the number of substitutions done.
2420  */
2421 int
xmlXIncludeProcessFlags(xmlDocPtr doc,int flags)2422 xmlXIncludeProcessFlags(xmlDocPtr doc, int flags) {
2423     return xmlXIncludeProcessFlagsData(doc, flags, NULL);
2424 }
2425 
2426 /**
2427  * xmlXIncludeProcess:
2428  * @doc: an XML document
2429  *
2430  * Implement the XInclude substitution on the XML document @doc
2431  *
2432  * Returns 0 if no substitution were done, -1 if some processing failed
2433  *    or the number of substitutions done.
2434  */
2435 int
xmlXIncludeProcess(xmlDocPtr doc)2436 xmlXIncludeProcess(xmlDocPtr doc) {
2437     return(xmlXIncludeProcessFlags(doc, 0));
2438 }
2439 
2440 /**
2441  * xmlXIncludeProcessTreeFlags:
2442  * @tree: a node in an XML document
2443  * @flags: a set of xmlParserOption used for parsing XML includes
2444  *
2445  * Implement the XInclude substitution for the given subtree
2446  *
2447  * Returns 0 if no substitution were done, -1 if some processing failed
2448  *    or the number of substitutions done.
2449  */
2450 int
xmlXIncludeProcessTreeFlags(xmlNodePtr tree,int flags)2451 xmlXIncludeProcessTreeFlags(xmlNodePtr tree, int flags) {
2452     xmlXIncludeCtxtPtr ctxt;
2453     int ret = 0;
2454 
2455     if ((tree == NULL) || (tree->type == XML_NAMESPACE_DECL) ||
2456         (tree->doc == NULL))
2457 	return(-1);
2458     ctxt = xmlXIncludeNewContext(tree->doc);
2459     if (ctxt == NULL)
2460 	return(-1);
2461     ctxt->base = xmlNodeGetBase(tree->doc, tree);
2462     xmlXIncludeSetFlags(ctxt, flags);
2463     ret = xmlXIncludeDoProcess(ctxt, tree);
2464     if ((ret >= 0) && (ctxt->nbErrors > 0))
2465 	ret = -1;
2466 
2467     xmlXIncludeFreeContext(ctxt);
2468     return(ret);
2469 }
2470 
2471 /**
2472  * xmlXIncludeProcessTree:
2473  * @tree: a node in an XML document
2474  *
2475  * Implement the XInclude substitution for the given subtree
2476  *
2477  * Returns 0 if no substitution were done, -1 if some processing failed
2478  *    or the number of substitutions done.
2479  */
2480 int
xmlXIncludeProcessTree(xmlNodePtr tree)2481 xmlXIncludeProcessTree(xmlNodePtr tree) {
2482     return(xmlXIncludeProcessTreeFlags(tree, 0));
2483 }
2484 
2485 /**
2486  * xmlXIncludeProcessNode:
2487  * @ctxt: an existing XInclude context
2488  * @node: a node in an XML document
2489  *
2490  * Implement the XInclude substitution for the given subtree reusing
2491  * the information and data coming from the given context.
2492  *
2493  * Returns 0 if no substitution were done, -1 if some processing failed
2494  *    or the number of substitutions done.
2495  */
2496 int
xmlXIncludeProcessNode(xmlXIncludeCtxtPtr ctxt,xmlNodePtr node)2497 xmlXIncludeProcessNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr node) {
2498     int ret = 0;
2499 
2500     if ((node == NULL) || (node->type == XML_NAMESPACE_DECL) ||
2501         (node->doc == NULL) || (ctxt == NULL))
2502 	return(-1);
2503     ret = xmlXIncludeDoProcess(ctxt, node);
2504     if ((ret >= 0) && (ctxt->nbErrors > 0))
2505 	ret = -1;
2506     return(ret);
2507 }
2508 
2509 #else /* !LIBXML_XINCLUDE_ENABLED */
2510 #endif
2511