Category
stdlib · php-src-strict · child of #3724 · SOAP encoding batch (XSD_ANYXML)
Problem
php-src to_xml_any() inserts the payload as an xmlStringTextNoenc node (no xsi:type, no extra element wrapper). A string '<raw>x</raw>' becomes a child of the operation element. VM htmlspecialchars-escapes the string and wraps it in <param0>.
| Repro (2026-08-18, php8.2-soap, SOAP_ENCODED RPC) |
Zend |
VM |
new SoapVar('<raw>x</raw>', XSD_ANYXML) |
<ns1:echo><raw>x</raw></ns1:echo> |
<ns1:echo><param0><raw>x</raw></param0></ns1:echo> |
new SoapVar('plain', XSD_ANYXML) |
plain (no wrapper, no xsi:type) |
<param0>plain</param0> |
php-src reference
PHP implementation target
ext/soap/VmSoapClient.php — encodeSoapVar() XSD_ANYXML path: unescaped fragment, no param wrapper / xsi:type
- Repro + compliance under
test/compliance/cases/stdlib/
Repro
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php test/repro/issue_soapvar_xsd_anyxml.php'
Done when
Category
stdlib· php-src-strict · child of #3724 · SOAP encoding batch (XSD_ANYXML)Problem
php-src
to_xml_any()inserts the payload as anxmlStringTextNoencnode (noxsi:type, no extra element wrapper). A string'<raw>x</raw>'becomes a child of the operation element. VM htmlspecialchars-escapes the string and wraps it in<param0>.new SoapVar('<raw>x</raw>', XSD_ANYXML)<ns1:echo><raw>x</raw></ns1:echo><ns1:echo><param0><raw>x</raw></param0></ns1:echo>new SoapVar('plain', XSD_ANYXML)plain(no wrapper, no xsi:type)<param0>plain</param0>php-src reference
ext/soap/php_encoding.c—to_xml_any()xmlStringTextNoencPHP implementation target
ext/soap/VmSoapClient.php—encodeSoapVar()XSD_ANYXMLpath: unescaped fragment, no param wrapper / xsi:typetest/compliance/cases/stdlib/Repro
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php test/repro/issue_soapvar_xsd_anyxml.php'Done when
'<raw>x</raw>'embeds as raw XML under the operation element (VM).phptguard