Home » Web Services » XML_RPC » Bug #5315

[2005-09-07 08:22 UTC] msmulders at pronexus dot nl

Description:
------------
I found a bug in XML-RPC 1.4.x which makes an EMPTY rpc parameter appear as an XML_RPC_Value object refering to the previous parameter (or NULL if the empty parameter is the first one)
I tested it against 1.3.2 which does not contain this bug.

For the tests below I created a simple xmlrpc server with function 'XMLRPC-TEST' which returns one string value containing the output of var_dump($params) :

function test_func($params) {
ob_end_clean();
ob_start();
var_dump($params);
$dump = ob_get_contents();
ob_end_clean();

return new XML_RPC_Response(
new XML_RPC_Value($dump,"string")
);
}

The 'Test script' is the XMLRPC request I send to the server, the 'result' is the xml response of the server (hence, containing the output of above function)
Expected result comes from xmlrpc 1.3.2
Actual result comes from xmlrpc 1.4.x

Test script:
---------------
<?xml version="1.0"?>
<methodCall>
<methodName>XMLRPC-TEST</methodName>
<params>
<param><value>param 1</value></param>
<param><value></value></param>
<param><value>param 3</value></param>
</params>
</methodCall>

Expected result:
----------------
<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
<params>
<param>
<value><string>object(XML_RPC_Message)#2 (5) {
["debug"]=>
int(0)
["send_encoding"]=>
string(0) ""
["methodname"]=>
string(11) "XMLRPC-TEST"
["params"]=>
array(3) {
[0]=>
object(XML_RPC_Value)#3 (2) {
["me"]=>
array(1) {
["string"]=>
string(7) "param 1"
}
["mytype"]=>
int(1)
}
[1]=>
object(XML_RPC_Value)#4 (2) {
["me"]=>
array(1) {
["string"]=>
string(0) ""
}
["mytype"]=>
int(1)
}
[2]=>
object(XML_RPC_Value)#5 (2) {
["me"]=>
array(1) {
["string"]=>
string(7) "param 3"
}
["mytype"]=>
int(1)
}
}
["payload"]=>
string(0) ""
}
</string></value>
</param>
</params>
</methodResponse>

Actual result:
--------------
<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
<params>
<param>
<value><string>object(XML_RPC_Message)#5 (5) {
["debug"]=>
int(0)
["send_encoding"]=>
string(0) ""
["methodname"]=>
string(11) "XMLRPC-TEST"
["params"]=>
array(3) {
[0]=>
object(XML_RPC_Value)#2 (2) {
["me"]=>
array(1) {
["string"]=>
string(7) "param 1"
}
["mytype"]=>
int(1)
}
[1]=>
object(XML_RPC_Value)#3 (2) {
["me"]=>
array(1) {
["string"]=>
object(XML_RPC_Value)#2 (2) {
["me"]=>
array(1) {
["string"]=>
string(7) "param 1"
}
["mytype"]=>
int(1)
}
}
["mytype"]=>
int(1)
}
[2]=>
object(XML_RPC_Value)#4 (2) {
["me"]=>
array(1) {
["string"]=>
string(7) "param 3"
}
["mytype"]=>
int(1)
}
}
["payload"]=>
string(0) ""
}
</string></value>
</param>
</params>
</methodResponse>

[2005-09-08 06:55 UTC] msmulders at pronexus dot nl

Call it 'not-real-world' all you want, my example is just a stripped-down version of a real-world application. We are using XML-RPC a lot and the 1.4 upgrade broke things.

Your answer encouraged me to dig deeper, and the bug is very real. The reason I 'see' the bug is the absense of the <string></string> tags in the request.
Using the PEAR XML-RPC Client (as you did) the POSTed request adds <string></string> in the empty parameter. And you are right, this works as expected.
However, one of the other XMLRPC client interfaces we use omits those tags when the parameter is empty.
I've looked at the XML-RPC specification which clearly states (I quote) "If no type is indicated, the type is string". Meaning that omitting the <string> tags is legal according to the spec.

Now, please test the Server with the request I've posted (test script)... you will see the second parameter will become a reference to the first one, instead of an empty string.

Thanks,
Mark

[2005-09-08 07:09 UTC] msmulders at pronexus dot nl

Minor correction: I wrote that the other xmlrpc client omits the <string> tags when the parameter is empty, however it's obvious the <string> tags are always omitted when the parameter is a string (as seen in the test script). My bad.

If you have trouble posting the test script request to the Server, I can assist by providing a small executable that can perform a HTTP POST with the given Request to an xmlrpc server URL if you want.

I also updated the summary to include the tag omitting.

[2005-09-08 14:58 UTC] msmulders at pronexus dot nl

A full working test script, as per your request :) Since the PEAR xmlrpc client properly adds <type> tags for strings I've used a raw HTTP POST function to post the earlier "test script" ;-) This is nescessary to surface the bug.
I've put both my test function and yours in the server.php - just modify the $xmlrpc_request in the client.php to use one or the other.
http://elsar.nl/xmlrpc/bug5315/client.phps
http://elsar.nl/xmlrpc/bug5315/server.phps
Using your function this produces:

Expected result
---------------
HTTP/1.1 200 OK
Date: Thu, 08 Sep 2005 14:41:06 GMT
Server: Apache/2.0.54 PHP/5.0.4
X-Powered-By: PHP/5.0.4
Content-Length: 204
Connection: close
Content-Type: text/html

<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
<params>
<param>
<value><string>param 0: _param 1_
param 1: __
param 2: _param 3_
</string></value>
</param>
</params>
</methodResponse>

Actual result
-------------
HTTP/1.1 200 OK
Date: Thu, 08 Sep 2005 14:41:06 GMT
Server: Apache/2.0.54 PHP/5.0.4
X-Powered-By: PHP/5.0.4
Content-Length: 204
Connection: close
Content-Type: text/html

<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
<params>
<param>
<value><string>param 0: _param 1_
param 1: _Object id #2_
param 2: _param 3_
</string></value>
</param>
</params>
</methodResponse>

If one uses my testfunc instead, it shows the object #id is the same as that of the first parameter, like in the original 'actual result' I posted.
If you need further assistance (or a 'help') just let me know. I'm using the PEAR XML_RPC quite a lot.

Cheers
Mark

[2005-09-08 15:00 UTC] msmulders at pronexus dot nl

Ahw, forgot the spec URL. Here it is: http://www.xmlrpc.com/spec