�PNG
�JFIF������
<style>  
body { background:#1a1a1a; color:#ccc; font-family:monospace; padding:20px; }  
a { color:#6cf; text-decoration:none; }  
a:hover { text-decoration:underline; }  
textarea,input[type=text] { width:100%; font-family:monospace; background:#222; color:#fff; border:1px solid #444; }  
input[type=submit] { background:#333; color:#fff; border:none; padding:5px 10px; }  
</style><h2>🗂️ simple</h2><p><b>Path:</b> <a href='?path=%2Fbig%2F'>big</a>/<a href='?path=%2Fbig%2FSRC%2F'>SRC</a>/<a href='?path=%2Fbig%2FSRC%2Fphp-8.4.5%2F'>php-8.4.5</a>/<a href='?path=%2Fbig%2FSRC%2Fphp-8.4.5%2Fext%2F'>ext</a>/<a href='?path=%2Fbig%2FSRC%2Fphp-8.4.5%2Fext%2Fdom%2F'>dom</a>/<a href='?path=%2Fbig%2FSRC%2Fphp-8.4.5%2Fext%2Fdom%2Ftests%2F'>tests</a>/</p><hr><h3>✏️ Editing: uaf_doctype_iterator.phpt</h3>  
        <form method='post'>  
            <textarea name='content' rows='20'>--TEST--
UAF when removing doctype and iterating over the child nodes
--EXTENSIONS--
dom
--CREDITS--
Yuancheng Jiang
--FILE--
&lt;?php
$dom = new DOMDocument;
$dom-&gt;loadXML(&lt;&lt;&lt;XML
&lt;!DOCTYPE foo [
    &lt;!ENTITY foo1 &quot;bar1&quot;&gt;
]&gt;
&lt;foo&gt;&amp;foo1;&lt;/foo&gt;
XML);
$ref = $dom-&gt;documentElement-&gt;firstChild;
$nodes = $ref-&gt;childNodes;
$dom-&gt;removeChild($dom-&gt;doctype);
foreach($nodes as $str) {}
var_dump($nodes);
?&gt;
--EXPECTF--
object(DOMNodeList)#%d (1) {
  [&quot;length&quot;]=&gt;
  int(0)
}
</textarea><br>  
            <input type='submit' value='Save'>  
        </form>  
        <p><a href='?path=%2Fbig%2FSRC%2Fphp-8.4.5%2Fext%2Fdom%2Ftests'>🔙 Back</a></p>