[veewee]

A WSDL can hold several inline schemas in its types section where one schema refers to an element or type of another without importing that namespace. ext-soap treats all inline schemas as one pool and accepts this. xsd-reader only resolves references through imports, so reading such a WSDL failed with "Can't find element named {namespace}#Name".

SchemaParser now adds the missing namespace-only imports between the inline schemas before handing them to xsd-reader. It leaves existing imports alone.

In phpro/soap-client#614 the provider's own schema refers to ns1:Vehicle without importing its namespace. The FlatteningLoader copies that schema as is, which is why flattening did not help.

Fixes phpro/soap-client#614

Summary by CodeRabbit

• Bug Fixes
  • Improved SOAP compatibility for inline XML schemas that reference one another without explicitly declaring imports. Related methods, types, and properties are now recognized when processing these schemas.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e4afb07b-0674-4b10-9f5b-537be8298bfa

📥 Commits

Reviewing files that changed from the base of the PR and between 6185fa2 and b2b87a9.

📒 Files selected for processing (2)

• src/Parser/Definitions/SchemaParser.php
• tests/PhpCompatibility/schema1017.phpt

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The parser adds missing XSD imports between inline schemas with distinct target namespaces. A PHPT test checks the generated method and types for schemas that reference each other without explicit imports.

Changes

Inline schema imports

Layer / File(s)	Summary
Add and validate sibling schema imports src/Parser/Definitions/SchemaParser.php, tests/PhpCompatibility/schema1017.phpt	legacySchemaNodes adds imports for sibling target namespaces that are not already represented by the schema’s own target namespace or a direct XSD import. The PHPT test checks generated method and type output for inline schemas without explicit imports.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to b2b87

This change is intended to let client generation resolve references between inline schemas. The pinned reader accepts the investigated import ordering, and no supported merge-blocking risk remains; the PR is ready subject to normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to b2b87

The change broadens visibility between schemas already supplied in the same WSDL without adding external schema locations. No introduced security vulnerability was established, but mutation isolation and resource growth for unusually large schema collections remain incompletely assessed.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The visible exposure is the process parsing an affected WSDL and consumers of its returned schema graph. An input provider can influence sibling namespace visibility through inline targetNamespace values. The supplied evidence does not establish a remotely reachable deployment, tenant-wide exposure, or a privilege increase.

Trust Boundaries and Controls

• observed — For namespace-only imports without a registered location or global namespace identity, the reader returns a deferred callback that connects already loaded schemas rather than deriving a URL from the namespace. Registered namespaces can select configured locations; the reader also has a bundled XML-signature schema mapping.
• observed — The existing parser registers and eagerly reads context-configured known schemas before processing inline schemas. The new helper does not alter those locations. External resource loading remains a capability of the reader's existing import path, rather than a newly generated schemaLocation sink.

Resilience and Maintainability Implications

• inferred — With N schemas having distinct nonempty namespaces and no existing imports, normalization creates N times (N minus 1) import nodes. This introduces input-dependent resource amplification within a parse. Whether it presents an exploitable availability risk depends on application input controls and parsing budgets, which were not established.

Hardening Proposals

• proposed — For applications accepting untrusted WSDLs, bound schema count or synthesized import count before normalization to contain quadratic resource growth. Establish explicit legacy-document ownership so parse failure cannot leave shared caller state partially transformed.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: resolving references between inline schemas that lack explicit imports.
Linked Issues check	✅ Passed	The change addresses issue [#614]. legacySchemaNodes() now adds missing namespace-only XSD imports between inline schemas before xsd-reader processes them. It preserves the schema target namespace a…
Out of Scope Changes check	✅ Passed	The reviewed changes are limited to the inline-schema import resolution in SchemaParser and its compatibility test. Both changes directly support issue [#614]. No unrelated production behavior or un…
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (1 skipped: 1 …

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[veewee]

Closing this in favour of goetas-webservices/xsd-reader#95.

Adding imports to the inline schemas was the wrong place to fix this. It makes every inline schema import every other one, which bloats the schema graph for WSDLs that were already fine: gordic.cz.wsdl, with 150 inline schemas, hit Xdebug's nesting limit, and 11 other WSDLs came out with their types in a different order.

The cause is in xsd-reader. Since goetas-webservices/xsd-reader#53 it resolves type references across sibling schemas without an import, but element, group, attribute and attributeGroup references never got that fallback. The xsd-reader PR makes all of those lookups consistent. Across the 122 WSDLs I compared, the WSDL from phpro/soap-client#614 is the only one whose output changes.