Commit c920daa7ec2 for php.net

commit c920daa7ec2eff3414a401c7551ad9ccc7201a70
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date:   Sat Mar 21 22:57:06 2026 +0100

    Fix GH-21486: Dom\HTMLDocument parser mangles xml:space and xml:lang attributes

    Closes GH-21489.

diff --git a/NEWS b/NEWS
index c94a84b1911..e10a9d68d49 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,10 @@ PHP                                                                        NEWS
   . Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in
     get_property_ptr_ptr for lazy proxies). (iliaal)

+- DOM:
+  . Fixed bug GH-21486 (Dom\HTMLDocument parser mangles xml:space and
+    xml:lang attributes). (ndossche)
+
 - GD:
   . Fixed bug GH-21431 (phpinfo() to display libJPEG 10.0 support).
     (David Carlier)
diff --git a/ext/dom/html5_parser.c b/ext/dom/html5_parser.c
index d5fe3d5c277..c00fa81b9c9 100644
--- a/ext/dom/html5_parser.c
+++ b/ext/dom/html5_parser.c
@@ -117,6 +117,7 @@ static lexbor_libxml2_bridge_status lexbor_libxml2_bridge_convert(
 	php_dom_libxml_ns_mapper *ns_mapper = php_dom_ns_mapper_from_private(private_data);
     xmlNsPtr html_ns = php_dom_libxml_ns_mapper_ensure_html_ns(ns_mapper);
     xmlNsPtr xlink_ns = NULL;
+    xmlNsPtr xml_ns = NULL;
     xmlNsPtr prefixed_xmlns_ns = NULL;

     lexbor_array_obj_t work_list;
@@ -256,6 +257,12 @@ static lexbor_libxml2_bridge_status lexbor_libxml2_bridge_convert(
                         xlink_ns->_private = (void *) php_dom_ns_is_xlink_magic_token;
                     }
                     lxml_attr->ns = xlink_ns;
+                } else if (attr->node.ns == LXB_NS_XML) {
+                    if (xml_ns == NULL) {
+                        xml_ns = php_dom_libxml_ns_mapper_get_ns_raw_strings_nullsafe(ns_mapper, "xml", DOM_XML_NS_URI);
+                        xml_ns->_private = (void *) php_dom_ns_is_xml_magic_token;
+                    }
+                    lxml_attr->ns = xml_ns;
                 }

                 if (last_added_attr == NULL) {
diff --git a/ext/dom/tests/modern/html/parser/gh21486.phpt b/ext/dom/tests/modern/html/parser/gh21486.phpt
new file mode 100644
index 00000000000..62df1e5ca6b
--- /dev/null
+++ b/ext/dom/tests/modern/html/parser/gh21486.phpt
@@ -0,0 +1,18 @@
+--TEST--
+GH-21486 (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes)
+--EXTENSIONS--
+dom
+--CREDITS--
+JKingweb
+--FILE--
+<?php
+$d = @\Dom\HTMLDocument::createFromString("<div></div>");
+$e = $d->getElementsByTagName("div")[0];
+$e->innerHTML = '<svg xml:space="default" xlink:href="about:blank" xmlns:foo="barspace"></svg>';
+$svg = $d->querySelector("svg");
+echo $e->innerHTML."\n";
+echo $svg->attributes[0]->localName." ".var_export($svg->attributes[0]->namespaceURI, true)."\n";
+?>
+--EXPECT--
+<svg xml:space="default" xlink:href="about:blank" xmlns:foo="barspace"></svg>
+space 'http://www.w3.org/XML/1998/namespace'