Repository navigation
Commit a42b30f
committed
p5-XML-LibXML: update to 2.0213.
2.0213 2026-05-21
[SECURITY / BUG FIXES]
- Revert PR NetBSD#143 per the libxml2 author's request. PR NetBSD#143 added a
URL-scheme filter inside LibXML_load_external_entity and removed
the EXTERNAL_ENTITY_LOADER_FUNC == NULL guards on the five
Schema/RelaxNG NONET swap sites, on the premise that
no_network on one parser should override a user-installed global
externalEntityLoader. Nick Wellnhofer clarified that this
contradicts upstream intent: XML_PARSE_NONET only polices
libxml2's default loader; a user who installs a global loader is
explicitly opting out of that policy, and the http/https/ftp
allowlist was never a real security boundary. Reverted in full;
PR NetBSD#138's lifecycle/memory-safety fixes are kept.
- GH NetBSD#168
[BUG FIXES]
- Fix latent SEGV in _externalEntityLoader. The XS code returned
&PL_sv_undef as RETVAL when no previous global loader existed.
Because xsubpp auto-mortalizes SV* RETVAL, each call mortalized
the PL_sv_undef singleton, eventually driving its refcount
negative and producing "Attempt to free unreferenced scalar"
followed by SEGV under repeated invocation. Now returns
newSV(0) so RETVAL is always a fresh refcount-1 SV safe to
mortalize. The bug shipped in 2.0212 with PR NetBSD#138's lifecycle
fixes; this is a single-line correction to that code path.
[MAINTENANCE]
- Add t/49global_extent_with_no_network.t, 17 subtests locking in
the entity-loader contract restored by the GH NetBSD#168 revert: a
user-installed global loader takes precedence over no_network
across plain XML parse, RelaxNG, and XML Schema, while
no_network without any loader still blocks via libxml2's
default loader.
- Document the entity-loader contract in CLAUDE.md
("Entity loaders, no_network, and XML_PARSE_NONET") plus a
"Verifying audit-flagged security findings" checklist to keep
pattern-matched "security fixes" like PR NetBSD#143 from shipping
again.
2.0212 2026-05-19
[BUG FIXES]
- Ship POD files in the CPAN tarball. The per-class .pod files
generated from docs/libxml.dbk were gitignored, and nothing in
the dist chain was producing them, so recent tarballs shipped
without POD. The .pod files are now tracked in git (bison-style),
so `make dist` includes them via MANIFEST and the documentation
reaches CPAN consumers again. Also eliminates the bootstrap
problem of needing XML::LibXML installed to build XML::LibXML's
docs, and silences the "kit incomplete" warning from
`perl Makefile.PL` on a fresh checkout.
[MAINTENANCE]
- Add a `pod-drift` CI job that runs `make pod_docs` and fails on
any diff, catching forgotten POD regenerations after edits to
docs/libxml.dbk.
- Move xmllibxmldocs.pl from example/ to scripts/. It is a
maintenance tool that emits source files (POD), not a usage
example of XML::LibXML; scripts/ already houses similar
build/dev tooling.
- Skip t/release-kwalitee.t outside a dist tarball. The
Test::Kwalitee `has_meta_yml` check was failing under
`make test` in author mode because META.yml is only generated
by `make dist`. The test now skips cleanly when META.yml is
absent and still runs the full 18-check suite under
`make disttest` against the unpacked tarball.
2.0211 2026-05-19
[SECURITY / BUG FIXES]
- Prevent out-of-bounds UTF-8 read in domParseChar by replacing it
with libxml2's xmlValidateName. Truncated multi-byte sequences
could cause heap reads past the NUL terminator across five DOM
entry points (createElement, createAttribute, setNodeName, etc.).
- GH NetBSD#146, PR NetBSD#149
- Enforce no_network even when a global externalEntityLoader is set.
Previously XML_PARSE_NONET was silently ignored once a global
callback was installed, enabling SSRF in multi-module applications
that combine a third-party entity loader with no_network parsers.
- GH NetBSD#133, PR NetBSD#143
- Prevent integer overflow in SAX CBuffer length tracking. Total
character data exceeding INT_MAX (~2GB) overflowed the accumulator
causing xmlMalloc to under-allocate and the subsequent memcpy to
write past the buffer.
- GH NetBSD#135, PR NetBSD#142
- Proper lifecycle management for externalEntityLoader: the global
loader can now be cleared or replaced safely, the previous handler
SV is no longer leaked, the returned value is a safe copy rather
than the internal global SV, and per-parser ext_ent_handler state
is separated from the global slot.
- PR NetBSD#138
- Add NULL checks after xmlMalloc returns in SAX CBuffer operations,
converting OOM segfaults into catchable Perl exceptions.
- GH NetBSD#136, PR NetBSD#140
- Add NULL check after xmlCopyNamespace in _domReconcileNs, matching
the existing guard in _domReconcileNsAttr.
- GH NetBSD#137, PR NetBSD#139
- Plug 11 memory leaks across XS/C code, including setBaseURI,
URI/documentURI accessors, load_catalog, PSaxCharactersFlush,
createAttributeNS, XPathContext::_find, _newForIO, _toStringC14N,
lookupNamespacePrefix, _setNamespace, and the generic XPath
extension function dispatcher.
- GH NetBSD#131, PR NetBSD#132
- Handle Apple's local libxml2 patch where xmlSAX2ResolveEntity
throws on a NULL URI, so t/13dtd.t no longer dies on macOS.
- RT #2021, PR NetBSD#102
- Skip t/50devel.t when mem_used() reports 0 bytes, which happens
on Apple's libxml2 (system malloc bypasses the tracking wrappers).
- RT #165193, PR NetBSD#94
[IMPROVEMENTS]
- Resolve Windows CI test failures and compiler warnings: use the
file size (-s) for the byteConsumed test instead of a hardcoded
488 (CRLF inflates the file to 507 bytes), use Perl UV/PTR2UV in
PmmRegistryName to avoid pointer truncation under Win64 LLP64,
and use const xmlError* for xmlCtxtGetLastError to match the
libxml2 2.12+ API.
- PR NetBSD#122
- Silence macOS build warnings cleanly by gating the libxml2 memory
tracking API behind a HAVE_LIBXML_MEMORY_DEBUG feature macro. The
deprecated calls are no longer compiled on systems where the API
is gone (Apple SDK, libxml2 >= 2.14), mem_used is only exported
when actually defined, and t/50devel.t skips with a clear reason.
Also strip the bogus "-L/lib" entries Alien::Base::Wrapper injects
into LDFLAGS on macOS.
- PR NetBSD#127
- Add a minimal hello-world HTML example (example/hello-world.pl)
and add createInternalSubset("html", ...) to both HTML examples
so they emit a proper <!DOCTYPE html> declaration.
- GH NetBSD#66, PR NetBSD#121
- Standardize XPath parameter naming to $xpath_expression throughout
the DocBook source, matching the XML::LibXML::XPathExpression
class name.
- GH NetBSD#64, PR NetBSD#125
- Update outdated and dead references in README.md: point repository
URLs at the canonical cpan-authors/XML-LibXML home, drop the
defunct ActiveState mailing list, replace the long Windows
nmake recipe with a Strawberry Perl note, refresh the macOS
section, and bring the Package History up to date.
- GH NetBSD#129, PR NetBSD#144
- Remove the stale "Known Issues" note about push-parser leaks.
The leaks it referenced were fixed by Nick Wellnhofer in 2014.
- Point distribution metadata at the cpan-authors GitHub repo and
add an explicit bugtracker entry so MetaCPAN's "Issues" link
goes to GitHub Issues instead of falling back to rt.cpan.org.
- Add NamedNodeMap.pod to MANIFEST so the generated POD ships in
the CPAN tarball; the L<XML::LibXML::NamedNodeMap> link in
Node.pod now resolves on MetaCPAN.
- GH NetBSD#115, PR NetBSD#118
- Update ppport.h and adopt its suggestions to reduce build issues.
- Fix test suite with libxml2 2.13.0 and 2.14.0.
- Remove tests that disable line numbers (always enabled since
libxml2 2.15.0).
- Use `our $VERSION` instead of `use vars`.
- Fix formatting in docs/libxml.dbk.
- GH NetBSD#85
[MAINTENANCE]
- Modernize the CI workflow with a dynamic Perl version matrix,
centralized cpanfile, and updated action versions.
- PR NetBSD#108
- Use cpanm instead of cpm for the Linux CI matrix so jobs on
Perl < 5.24 (down through 5.8) no longer fail to install
dependencies.
- GH NetBSD#117, PR NetBSD#119
- Expand CI platform coverage: FreeBSD 14.2, OpenBSD 7.6, NetBSD
10.1, Strawberry Perl on Windows, Fedora 43 container,
AddressSanitizer, Devel::Cover + Codecov coverage upload, and a
downstream XML::LibXSLT compatibility job.
- PR NetBSD#120
- Fix BSD CI: use the correct OpenBSD package name (`libxml`, not
`libxml2`) and install Perl dependencies explicitly instead of
relying on META.json autodiscovery.
- PR NetBSD#124
- Parallelize `make` compilation across CI jobs with
platform-appropriate CPU detection.
- PR NetBSD#128
- Temporarily disable OpenBSD 7.6 CI due to unreliable runners.
- PR NetBSD#130
- Re-enable OpenBSD CI on version 7.8 once the runner situation
stabilized.
- PR NetBSD#144
- Add a CLAUDE.md describing project layout, build/test commands,
libxml2 version landscape, and coding conventions.
- PR NetBSD#116
- Add contributing guidelines covering CI, scope, MANIFEST, and
version/release handling.
- PR NetBSD#126
- Add AI_POLICY.md documenting how AI tools are used (and not used)
in this project.
- Add MANIFEST.SKIP so local files (.hgignore, .tidyallrc, CLAUDE.md,
etc.) are kept out of `make manifest` output.
- Drop unused dev helper (`tester.sh`) and the stale TODO file.
- Rename README to README.md and remove the obsolete Travis CI
references.1 parent 85fd810 commit a42b30f
8 files changed
Lines changed: 7 additions & 380 deletions
File tree
- textproc/p5-XML-LibXML
- patches
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | | - | |
| 1 | + | |
2 | 2 | | |
3 | | - | |
| 3 | + | |
4 | 4 | | |
5 | | - | |
6 | 5 | | |
7 | | - | |
| 6 | + | |
8 | 7 | | |
9 | 8 | | |
10 | 9 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1 | | - | |
| 1 | + | |
2 | 2 | | |
3 | | - | |
4 | | - | |
5 | | - | |
6 | | - | |
7 | | - | |
8 | | - | |
9 | | - | |
10 | | - | |
11 | | - | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
This file was deleted.
0 commit comments