fix SchemaValidatableElementTrait::schemaValidate inconsistent behavior across modules. Fix bugs.

Author: ioigoume

src/XML/DOMDocumentFactory.php

@@ -97,7 +97,7 @@ static function (int $severity, string $message): never {
             restore_error_handler();
         }
 
-        foreach ($domDocument->childNodes as $child) {
+        foreach ($loaded->childNodes as $child) {
             Assert::false(
                 $child->nodeType === \XML_DOCUMENT_TYPE_NODE,
                 'Dangerous XML detected, DOCTYPE nodes are not allowed in the XML body',
@@ -245,7 +245,7 @@ public static function lookupNamespaceURI(Dom\Element $elt, ?string $prefix): ?s
         }
 
         /** @var \Dom\NamespaceInfo[] $namespaces */
-        $namespaces = $elt->ownerDocument->documentElement->getInScopeNamespaces();
+        $namespaces = $elt->getInScopeNamespaces();
 
         foreach ($namespaces as $ns) {
             if ($ns->prefix === $prefix) {

src/XML/SchemaValidatableElementTrait.php

@@ -5,6 +5,7 @@
 namespace SimpleSAML\XML;
 
 use Dom;
+use Dom\XMLDocument;
 use SimpleSAML\XML\Assert\Assert;
 use SimpleSAML\XML\Exception\IOException;
 use SimpleSAML\XML\Exception\RuntimeException;
@@ -41,29 +42,55 @@ public static function schemaValidate(Dom\Document $document, ?string $schemaFil
         $internalErrors = libxml_use_internal_errors(true);
         libxml_clear_errors();
 
-        if ($schemaFile === null) {
-            $schemaFile = self::getSchemaFile();
-        }
+        try {
+            if ($schemaFile === null) {
+                $schemaFile = self::getSchemaFile();
+            }
 
-        // Must suppress the warnings here in order to throw them as an error below.
-        $result = @$document->schemaValidate($schemaFile);
+            if (!$document instanceof XMLDocument) {
+                throw new \LogicException('Schema validation requires an instance of Dom\\XMLDocument.');
+            }
 
-        if ($result === false) {
-            $msgs = [];
-            foreach (libxml_get_errors() as $err) {
-                $msgs[] = trim($err->message) . ' on line ' . $err->line;
+            /**
+             * Validates using a legacy \DOMDocument round-trip (serialize + re-parse) before running schema validation.
+             * This avoids false negatives seen with Dom\Document::schemaValidate(), especially around xs:QName
+             * prefix scope. Validation is performed against the exact serialized XML that would be
+             * exchanged externally.
+             */
+            $root = $document->documentElement;
+            if ($root === null) {
+                throw new SchemaViolationException('The document has no document element.');
             }
 
-            throw new SchemaViolationException(sprintf(
-                "XML schema validation errors:\n - %s",
-                implode("\n - ", array_unique($msgs)),
-            ));
-        }
+            $xml = $document->saveXml($root);
+            if ($xml === false || trim($xml) === '') {
+                throw new SchemaViolationException('Could not serialize XML for schema validation.');
+            }
 
-        libxml_use_internal_errors($internalErrors);
-        libxml_clear_errors();
+            $legacy = new \DOMDocument('1.0', 'UTF-8');
+            $legacy->preserveWhiteSpace = true;
+            $legacy->formatOutput = false;
+            $legacy->loadXML($xml);
 
-        return $document;
+            $result = $legacy->schemaValidate($schemaFile);
+
+            if ($result === false) {
+                $msgs = [];
+                foreach (libxml_get_errors() as $err) {
+                    $msgs[] = trim($err->message) . ' on line ' . $err->line;
+                }
+
+                throw new SchemaViolationException(sprintf(
+                    "XML schema validation errors:\n - %s",
+                    implode("\n - ", array_unique($msgs)),
+                ));
+            }
+
+            return $document;
+        } finally {
+            libxml_clear_errors();
+            libxml_use_internal_errors($internalErrors);
+        }
     }