fix(transport): Guard invalid XML in modTransportProvider - #16975
Open
Ibochkarev wants to merge 2 commits into
Open
fix(transport): Guard invalid XML in modTransportProvider#16975Ibochkarev wants to merge 2 commits into
Ibochkarev wants to merge 2 commits into
Conversation
When a transport provider returns non-XML, simplexml_load_string() returns false and calling getName() fatals on PHP 8. Apply the same guard as latest() (modxcms#16326) to find() and six other methods so the Package Manager returns provider_err_invalid_xml instead of breaking the connector JSON response. Fixes modxcms#16974
Move repeated invalid-XML guard from eight call sites into a single protected method. Behavior unchanged; error logging context is still passed per caller.
Ibochkarev
marked this pull request as ready for review
July 23, 2026 07:14
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed and why
Seven methods in
modTransportProvidercalledsimplexml_load_string()and used the result without checking for parse failure. When a transport provider returns empty, HTML, or truncated content, PHP 8 fatals on$xml->getName().This PR adds the same guard already in the second branch of
latest()(#16326) torepositories(),categories(),stats(),info(),latest()(package name branch),find(), andverify(). Failed parses log the raw body and returnprovider_err_invalid_xml. The connector keeps returning JSON, so the Package Browser grid no longer hits ExtJS decode errors.How to test
Point a transport provider at a URL that returns HTML or an empty body, then open Manager → Extras → Installer. You should see a provider error message, not a PHP fatal. The error log should contain the raw response body.
Related issue(s)/PR(s)
Resolves #16974
Refs #16326
Compatibility notes
Universal. No config or platform dependency. Uses existing lexicon key
provider_err_invalid_xml.Breaking change assessment
No signature or return type changes. Methods that already returned error strings on provider
<error>XML now also return a string on invalid XML.verify()can return the lexicon string instead of(bool)falsewhen the response is non-XML;Create.phpandUpdate.phpalready handle non-boolean results viais_bool($verified).Test coverage
No automated tests added. Same pattern as #16326. Manual verification against a misconfigured provider URL is sufficient.
Contributors
@Ibochkarev
AI tool use
Cursor AI assisted with implementation and PR preparation.