Security update for Core, with self-updated composer

[yaffs-website] / vendor / symfony / serializer / Encoder / XmlEncoder.php

diff --git a/vendor/symfony/serializer/Encoder/XmlEncoder.php b/vendor/symfony/serializer/Encoder/XmlEncoder.php
index 40f61167b36989e1f2a630cb86f931b85f25a9de..ad058118fab3eb95b9269084dbfda5cc5939f83f 100644 (file)
--- a/vendor/symfony/serializer/Encoder/XmlEncoder.php
+++ b/vendor/symfony/serializer/Encoder/XmlEncoder.php
@@ -30,15 +30,18 @@ class XmlEncoder extends SerializerAwareEncoder implements EncoderInterface, Dec
     private $format;
     private $context;
     private $rootNodeName = 'response';
+    private $loadOptions;
 
     /**
      * Construct new XmlEncoder and allow to change the root node element name.
      *
-     * @param string $rootNodeName
+     * @param string   $rootNodeName
+     * @param int|null $loadOptions  A bit field of LIBXML_* constants
      */
-    public function __construct($rootNodeName = 'response')
+    public function __construct($rootNodeName = 'response', $loadOptions = null)
     {
         $this->rootNodeName = $rootNodeName;
+        $this->loadOptions = null !== $loadOptions ? $loadOptions : LIBXML_NONET | LIBXML_NOBLANKS;
     }
 
     /**
@@ -81,7 +84,7 @@ class XmlEncoder extends SerializerAwareEncoder implements EncoderInterface, Dec
         libxml_clear_errors();
 
         $dom = new \DOMDocument();
-        $dom->loadXML($data, LIBXML_NONET | LIBXML_NOBLANKS);
+        $dom->loadXML($data, $this->loadOptions);
 
         libxml_use_internal_errors($internalErrors);
         libxml_disable_entity_loader($disableEntities);
@@ -301,11 +304,19 @@ class XmlEncoder extends SerializerAwareEncoder implements EncoderInterface, Dec
         $data = array();
 
         foreach ($node->attributes as $attr) {
-            if (ctype_digit($attr->nodeValue)) {
-                $data['@'.$attr->nodeName] = (int) $attr->nodeValue;
-            } else {
+            if (!is_numeric($attr->nodeValue)) {
                 $data['@'.$attr->nodeName] = $attr->nodeValue;
+
+                continue;
+            }
+
+            if (false !== $val = filter_var($attr->nodeValue, FILTER_VALIDATE_INT)) {
+                $data['@'.$attr->nodeName] = $val;
+
+                continue;
             }
+
+            $data['@'.$attr->nodeName] = (float) $attr->nodeValue;
         }
 
         return $data;
@@ -460,7 +471,7 @@ class XmlEncoder extends SerializerAwareEncoder implements EncoderInterface, Dec
      */
     private function needsCdataWrapping($val)
     {
-        return preg_match('/[<>&]/', $val);
+        return 0 < preg_match('/[<>&]/', $val);
     }
 
     /**