Enhance XML Loader to tolerate whitespace #576
Conversation
daffodil-lib/src/test/scala/org/apache/daffodil/xml/test/unit/TestXMLLoader.scala
Show resolved
Hide resolved
daffodil-lib/src/main/scala/org/apache/daffodil/xml/DaffodilConstructingLoader.scala
Show resolved
Hide resolved
daffodil-lib/src/main/scala/org/apache/daffodil/xml/DaffodilConstructingLoader.scala
Show resolved
Hide resolved
daffodil-lib/src/main/scala/org/apache/daffodil/xml/DaffodilConstructingLoader.scala
Outdated
Show resolved
Hide resolved
daffodil-lib/src/main/scala/org/apache/daffodil/xml/DaffodilConstructingLoader.scala
Outdated
Show resolved
Hide resolved
daffodil-lib/src/main/scala/org/apache/daffodil/xml/DaffodilConstructingLoader.scala
Outdated
Show resolved
Hide resolved
| * This does not handle DOCTYPEs (aka DTDs) at all. Hence, is not | ||
| * a true replacement (bug fix) on the original ConstructingParser method | ||
| * that it overrides. | ||
| */ |
There was a problem hiding this comment.
Suppose upstream takes your document() change to tolerate whitespace before the first < character and other big fixes, could you also suggest they take a change to make it easier to load XML securely? Maybe the upstream PR could let us override a doctype function or something like that so we don't need to duplicate any upstream code in our constructing parser implementation here.
There was a problem hiding this comment.
Interestingly, the scala xml library now defaults (as of version 2.0.0) to "secure". So they've taken that step.
What I don't know is the exact details of what they consider "secure". Does it apply to the constructing parser as well as the regular load calls, etc. Also, e.g., do they disallow DocTypes entirely, or just external entity usage, or ???
Which is why the earlier PR to specify no doctype to be used, so we know exactly how strict we are being.
I will try to get changes to the constructing parser upstreamed.
There was a problem hiding this comment.
Scala XML ticket: scala/scala-xml#532
| def fatalError(exception: SAXParseException) = { | ||
| exceptions += exception | ||
| } | ||
| } |
There was a problem hiding this comment.
No newline at end of file (but up to you).
ConstructingParser was intolerant of files that didn't start with "<". Modified to allow whitespace, processing instructions, and comments to precede the document element. Tests are testLoaderToleratesXMLWithLeadingWhitespace testLoaderToleratesXMLWithLeadingComments testLoaderToleratesXMLWithPI Further enhanced to handle PI that starts with <?xml-model ...?> This occurs in test infoset data for the iCalendar DFDL schema. Xerces was tolerating this before, so our constructing loader should also. DAFFODIL-2527
ConstructingParser was intolerant of files that didn't
start with "<".
Modified to allow whitespace, processing instructions, and comments
to precede the document element.
Tests are
testLoaderToleratesXMLWithLeadingWhitespace
testLoaderToleratesXMLWithLeadingComments
testLoaderToleratesXMLWithPI
DAFFODIL-2527