Add the option to perform schema validation over messages before parsing them.

Author: tvdijen

src/DOMDocumentFactory.php

@@ -5,18 +5,25 @@
 namespace SimpleSAML\XML;
 
 use DOMDocument;
+use Exception;
+use LibXMLError;
 use SimpleSAML\Assert\Assert;
 use SimpleSAML\XML\Exception\IOException;
 use SimpleSAML\XML\Exception\RuntimeException;
+use SimpleSAML\XML\Exception\SchemaViolationException;
 use SimpleSAML\XML\Exception\UnparseableXMLException;
+use XMLReader;
 
+use function array_unique;
 use function file_get_contents;
 use function func_num_args;
+use function implode;
 use function libxml_clear_errors;
 use function libxml_get_last_error;
 use function libxml_set_external_entity_loader;
 use function libxml_use_internal_errors;
 use function sprintf;
+use function trim;
 
 /**
  * @package simplesamlphp/xml-common
@@ -32,12 +39,14 @@ final class DOMDocumentFactory
 
     /**
      * @param string $xml
+     * @param string|null $schemaFile
      * @param non-negative-int $options
      *
      * @return \DOMDocument
      */
     public static function fromString(
         string $xml,
+        ?string $schemaFile = null,
         int $options = self::DEFAULT_OPTIONS,
     ): DOMDocument {
         libxml_set_external_entity_loader(null);
@@ -57,6 +66,11 @@ public static function fromString(
             $options |= LIBXML_NO_XXE;
         }
 
+        // Perform optional schema validation
+        if (!empty($schemaFile)) {
+            self::schemaValidation($xml, $schemaFile, $options);
+        }
+
         $domDocument = self::create();
         $loaded = $domDocument->loadXML($xml, $options);
 
@@ -85,12 +99,16 @@ public static function fromString(
 
     /**
      * @param string $file
+     * @param string|null $schemaFile
      * @param non-negative-int $options
      *
      * @return \DOMDocument
      */
-    public static function fromFile(string $file, int $options = self::DEFAULT_OPTIONS): DOMDocument
-    {
+    public static function fromFile(
+        string $file,
+        ?string $schemaFile = null,
+        int $options = self::DEFAULT_OPTIONS,
+    ): DOMDocument {
         error_clear_last();
         $xml = @file_get_contents($file);
         if ($xml === false) {
@@ -101,7 +119,9 @@ public static function fromFile(string $file, int $options = self::DEFAULT_OPTIO
         }
 
         Assert::notWhitespaceOnly($xml, sprintf('File "%s" does not have content', $file), RuntimeException::class);
-        return (func_num_args() === 1) ? static::fromString($xml) : static::fromString($xml, $options);
+        return (func_num_args() < 3)
+            ? static::fromString($xml, $schemaFile)
+            : static::fromString($xml, $schemaFile, $options);
     }
 
 
@@ -114,4 +134,49 @@ public static function create(string $version = '1.0', string $encoding = 'UTF-8
     {
         return new DOMDocument($version, $encoding);
     }
+
+
+    /**
+     * Validate an XML-string against a given schema.
+     *
+     * @param string $xml
+     * @param string $schemaFile
+     * @param int $options
+     *
+     * @throws \SimpleSAML\XML\Exception\SchemaViolationException when validation fails.
+     */
+    public static function schemaValidation(
+        string $xml,
+        string $schemaFile,
+        int $options = self::DEFAULT_OPTIONS,
+    ): void {
+        $xmlReader = XMLReader::XML($xml, null, $options);
+        Assert::notFalse($xmlReader, SchemaViolationException::class);
+
+        libxml_use_internal_errors(true);
+
+        try {
+            $xmlReader->setSchema($schemaFile);
+        } catch (Exception) {
+            $err = libxml_get_last_error();
+            throw new SchemaViolationException(trim($err->message) . ' on line ' . $err->line);
+        }
+
+        $msgs = [];
+        while ($xmlReader->read()) {
+            if (!$xmlReader->isValid()) {
+                $err = libxml_get_last_error();
+                if ($err instanceof LibXMLError) {
+                    $msgs[] = trim($err->message) . ' on line ' . $err->line;
+                }
+            }
+        }
+
+        if ($msgs) {
+            throw new SchemaViolationException(sprintf(
+                "XML schema validation errors:\n - %s",
+                implode("\n - ", array_unique($msgs)),
+            ));
+        }
+    }
 }