/ 
XML-LibXML-2.0213

Changes for version 2.0213 - 2026-05-21

  • SECURITY / BUG FIXES
    • Revert PR #143 per the libxml2 author's request. PR #143 added a URL-scheme filter inside LibXML_load_external_entity and removed the EXTERNAL_ENTITY_LOADER_FUNC == NULL guards on the five Schema/RelaxNG NONET swap sites, on the premise that no_network on one parser should override a user-installed global externalEntityLoader. Nick Wellnhofer clarified that this contradicts upstream intent: XML_PARSE_NONET only polices libxml2's default loader; a user who installs a global loader is explicitly opting out of that policy, and the http/https/ftp allowlist was never a real security boundary. Reverted in full; PR #138's lifecycle/memory-safety fixes are kept.
  • BUG FIXES
    • Fix latent SEGV in _externalEntityLoader. The XS code returned &PL_sv_undef as RETVAL when no previous global loader existed. Because xsubpp auto-mortalizes SV* RETVAL, each call mortalized the PL_sv_undef singleton, eventually driving its refcount negative and producing "Attempt to free unreferenced scalar" followed by SEGV under repeated invocation. Now returns newSV(0) so RETVAL is always a fresh refcount-1 SV safe to mortalize. The bug shipped in 2.0212 with PR #138's lifecycle fixes; this is a single-line correction to that code path.
  • MAINTENANCE
    • Add t/49global_extent_with_no_network.t, 17 subtests locking in the entity-loader contract restored by the GH #168 revert: a user-installed global loader takes precedence over no_network across plain XML parse, RelaxNG, and XML Schema, while no_network without any loader still blocks via libxml2's default loader.
    • Document the entity-loader contract in CLAUDE.md ("Entity loaders, no_network, and XML_PARSE_NONET") plus a "Verifying audit-flagged security findings" checklist to keep pattern-matched "security fixes" like PR #143 from shipping again.

Documentation

AI_POLICY.md
README.md
XML::LibXML::Attr
XML::LibXML Attribute Class
XML::LibXML::CDATASection
XML::LibXML Class for CDATA Sections
XML::LibXML::Comment
XML::LibXML Comment Class
XML::LibXML::DOM
XML::LibXML DOM Implementation
XML::LibXML::Document
XML::LibXML DOM Document Class
XML::LibXML::DocumentFragment
XML::LibXML's DOM L2 Document Fragment Implementation
XML::LibXML::Dtd
XML::LibXML DTD Handling
XML::LibXML::Element
XML::LibXML Class for Element Nodes
XML::LibXML::InputCallback
XML::LibXML Class for Input Callbacks
XML::LibXML::NamedNodeMap
A map for named nodes
XML::LibXML::Namespace
XML::LibXML Namespace Implementation
XML::LibXML::Node
Abstract Base Class of XML::LibXML Nodes
XML::LibXML::PI
XML::LibXML Processing Instructions
XML::LibXML::Parser
Parsing XML Data with XML::LibXML
XML::LibXML::Pattern
XML::LibXML::Pattern - interface to libxml2 XPath patterns
XML::LibXML::RegExp
XML::LibXML::RegExp - interface to libxml2 regular expressions
XML::LibXML::RelaxNG
RelaxNG Schema Validation
XML::LibXML::Schema
XML Schema Validation
XML::LibXML::Text
XML::LibXML Class for Text Nodes
XML::LibXML::XPathExpression
XML::LibXML::XPathExpression - interface to libxml2 pre-compiled XPath expressions
Test.pm-to-Test-More.pl
semi-automatically and partially convert Test.pm scripts to Test::More.

Modules

XML::LibXML
Perl Binding for libxml2
XML::LibXML::AttributeHash
tie an XML::LibXML::Element to a hash to access its attributes
XML::LibXML::Boolean
Boolean true/false values
XML::LibXML::Common
Constants and Character Encoding Routines
XML::LibXML::Devel
makes functions from LibXML.xs available
XML::LibXML::ErrNo
Structured Errors
XML::LibXML::Error
Structured Errors
XML::LibXML::Literal
Simple string values.
XML::LibXML::NodeList
a list of XML document nodes
XML::LibXML::Number
Simple numeric values.
XML::LibXML::Reader
XML::LibXML::Reader - interface to libxml2 pull parser
XML::LibXML::SAX
XML::LibXML direct SAX parser
XML::LibXML::SAX::Builder
Building DOM trees from SAX events.
XML::LibXML::SAX::Generator
Generate SAX events from a LibXML tree
XML::LibXML::XPathContext
XPath Evaluation

Provides

XML::LibXML::Attr
in LibXML.pm
XML::LibXML::CDATASection
in LibXML.pm
XML::LibXML::Comment
in LibXML.pm
XML::LibXML::Document
in LibXML.pm
XML::LibXML::DocumentFragment
in LibXML.pm
XML::LibXML::Dtd
in LibXML.pm
XML::LibXML::Element
in LibXML.pm
XML::LibXML::InputCallback
in LibXML.pm
XML::LibXML::NamedNodeMap
in LibXML.pm
XML::LibXML::Namespace
in LibXML.pm
XML::LibXML::Node
in LibXML.pm
XML::LibXML::PI
in LibXML.pm
XML::LibXML::Pattern
in LibXML.pm
XML::LibXML::RegExp
in LibXML.pm
XML::LibXML::RelaxNG
in LibXML.pm
XML::LibXML::SAX::AttributeNode
in lib/XML/LibXML/SAX/Generator.pm
XML::LibXML::SAX::Parser
in lib/XML/LibXML/SAX/Parser.pm
XML::LibXML::Schema
in LibXML.pm
XML::LibXML::Text
in LibXML.pm
XML::LibXML::XPathExpression
in LibXML.pm
XML::LibXML::_SAXParser
in LibXML.pm

Examples

Other files