Skip to content

fix: silence libxml2 parser errors on every libxml2 version - #3677

Open
fzipi wants to merge 2 commits into
owasp-modsecurity:v3/masterfrom
fzipi:v3/issue-3563-libxml2-stderr
Open

fix: silence libxml2 parser errors on every libxml2 version#3677
fzipi wants to merge 2 commits into
owasp-modsecurity:v3/masterfrom
fzipi:v3/issue-3563-libxml2-stderr

Conversation

@fzipi

@fzipi fzipi commented Oct 13, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Collaborator

what

Replace the direct ctxt->options |= XML_PARSE_NOWARNING | XML_PARSE_NOERROR assignments in the XML body processor with xmlCtxtUseOptions().

why

Since 3.0.15, a malformed XML request body makes libxml2 print its own error (body.xml:1: parser error : Extra content at the end of the document plus the context lines) to stderr. With the nginx connector that lands in error.log without the usual timestamp prefix (#3563).

  • 624a0de removed the deprecated xmlSetGenericErrorFunc() call with a null handler, which is what kept 3.0.14 quiet.
  • b9dc9cc tried to compensate by OR-ing the NOERROR/NOWARNING flags straight into ctxt->options.
  • libxml2 only honours flags stored that way from 2.13 on. Older releases (2.9 through 2.12: Amazon Linux 2023, Ubuntu 22.04, RHEL 9, Debian 12) apply them inside xmlCtxtUseOptions() by clearing the SAX error callbacks, so the direct assignment is a no-op there. That is why the reporters on Amazon Linux see the lines and the maintainers on newer distros could not reproduce.

xmlCtxtUseOptions() works on both old and new libxml2 and is not deprecated.

Verified with a small push-parser program against libxml2 2.9.13 and 2.15.4:

libxml2 no flags options |= (current) xmlCtxtUseOptions()
2.9.13 prints error prints error silent
2.15.4 prints error silent silent

and with the existing variable-REQBODY_PROCESSOR_ERROR.json regression test on a build linked against 2.9.13: one parser error line on stderr before, none after. The regression harness cannot assert on stderr, so there is no new automated test.

references

Fixes #3563. Related: #3455 (624a0de, b9dc9cc).

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Refactor
    • Updated XML parsing configuration. There are no user-visible changes; parsing behavior and the handling of parser warnings and errors remain unchanged. No new features or bug fixes are included in this update.

@fzipi @claude
fix: silence libxml2 parser errors on every libxml2 version
c3c7ba8 
Since 3.0.15 (b9dc9cc) the XML body processor sets XML_PARSE_NOERROR and
XML_PARSE_NOWARNING by OR-ing them into ctxt->options directly. libxml2
only honours options stored that way from 2.13 on; older releases (2.9
through 2.12, e.g. Amazon Linux 2023, Ubuntu 22.04, RHEL 9) apply the
flags inside xmlCtxtUseOptions() by clearing the SAX error callbacks, so
the direct assignment is a no-op and every malformed body prints
"body.xml:1: parser error : ..." to stderr, which nginx forwards to its
error log without a timestamp prefix. 3.0.14 did not show this because
it still called xmlSetGenericErrorFunc() with a null handler, which
624a0de removed as deprecated.

Call xmlCtxtUseOptions() instead, which works on both old and new
libxml2 and is not deprecated. Verified with a push-parser test program
against libxml2 2.9.13 and 2.15.4, and with the existing
variable-REQBODY_PROCESSOR_ERROR regression test, whose stderr output
goes from one parser error line to none.

Fixes owasp-modsecurity#3563

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Oct 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Review in Change Stack →

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 88723750-3139-419d-beda-541406577473
📥 Commits

Reviewing files that changed from the base of the PR and between c3c7ba8 and c04d2de.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 80168517-6830-46bb-8eb9-03d6459fd07f
📥 Commits

Reviewing files that changed from the base of the PR and between 48e561b and c3c7ba8.

📒 Files selected for processing (1)
  • src/request_body_processor/xml.cc

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Walkthrough

Both XML parser contexts now set warning and error suppression flags through xmlCtxtUseOptions instead of modifying the context’s options field directly.

Changes: XML parser option configuration

Layer / File(s) Summary
Apply options to both parser contexts
src/request_body_processor/xml.cc		 The document parser and ARGS SAX parser now apply the warning and error suppression flags through xmlCtxtUseOptions.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: airween

Merge Risk: ⚪ Minimal · up to c3c7b

The change applies XML diagnostic-suppression settings through libxml2’s API. No concrete regression in the supported repository workflow is established, so no actionable merge blocker remains.

Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed Passed checks (4 passed)
Check name Status Explanation
Linked Issues check Passed Issue #3563 reports unwanted libxml2 parser-error output for malformed XML request bodies. In src/request_body_processor/xml.cc, both push-parser contexts now call xmlCtxtUseOptions() with `XML_PA…
Out of Scope Changes check Passed The reviewed change is limited to XML body-parser option configuration in src/request_body_processor/xml.cc. Both modified calls support the #3563 objective. The summary reports no public API change…
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly describes the main change: silencing libxml2 parser errors across supported libxml2 versions.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

This was referenced Oct 13, 2026
Open
Open
Open
Open
Open
@airween airween added the 3.x Related to ModSecurity version 3.x label Oct 16, 2026
@sonarqubecloud

sonarqubecloud Bot commented Oct 17, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

3.x Related to ModSecurity version 3.x

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

REQBODY_ERROR "Extra content at the end of the document" after 3.0.15 update

2 participants

@fzipi @airween