NodetteHQ/PureXML
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat(schema): top-level element may not have ref/form/minOccurs/maxOccurs (topLevelElement)

Browse Source 
A top-level xs:element declaration (a direct child of schema, or of redefine) was
accepted with ref, form, minOccurs, or maxOccurs. A global element is a
declaration, never a particle or a reference, so those local-use attributes are
prohibited by the schema-for-schemas topLevelElement. The top-level-attribute
applicability scan is generalized into topLevelDeclarationErrors, driven by a
per-kind forbidden-attribute map, covering both attribute and element. A local
element particle inside a content model is unaffected.

XSTS: invalid schemas accepted 424 to 422, no other bucket raised.
This commit is contained in:
Mihaela Mihaljevic 2026-06-15 14:39:05 +02:00
parent 7ed7059134
commit 44d37a1a5f
6 changed files with 66 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
### Fixed
- A top-level `xs:element` declaration may no longer carry `ref`, `form`, `minOccurs`, or `maxOccurs` (XSD 1.0 schema-for-schemas `topLevelElement`, #170). A global element is a declaration, never a particle or a reference, so those local-use attributes are invalid. The top-level-attribute applicability scan added earlier is generalized to cover both kinds; a local element particle inside a content model is unaffected. XSTS: invalid schemas accepted 424 to 422, no other bucket raised.
- An element `ref` may no longer carry `nillable`, `default`, `fixed`, `form`, or `block`, and an element or attribute `ref` may no longer have an inline type definition (XSD 1.0 `src-element.2.2`, #170). A reference is a use of a global declaration, not a declaration, so beyond `ref` it carries only `minOccurs`, `maxOccurs`, and `id`; the applicability check already excluded `name` and `type` from a `ref`, and this extends the exclusion to the remaining declaration-only properties. A `group`/`attributeGroup` ref and an attribute ref's `use`/`default`/`fixed` (which override on the use) are unaffected. XSTS: invalid schemas accepted 439 to 424, no other bucket raised. Disclosed under-detection: a `key`/`unique`/`keyref` child under a ref is not yet flagged.
- A top-level `xs:attribute` declaration may no longer carry `use`, `form`, or `ref` (XSD 1.0 schema-for-schemas `topLevelAttribute`, #170). Those belong to a local attribute use, not a global declaration; the per-component applicability table is the permissive global/local union and so could not draw the distinction, leaving such schemas accepted. A focused scan of the direct `attribute` children of `schema` (and of `redefine`) supplies the global-only constraint; a local attribute use inside a complex type or attribute group is unaffected. XSTS: invalid schemas accepted 454 to 439, no other bucket raised.
- A `default`/`fixed` value on an element or attribute whose `type` names a user-declared type must now be a valid value of that type (XSD 1.0 `e-props-correct.2` / `a-props-correct.2`, #170). This runs after the named types are compiled, complementing the existing built-in-only check: a `default` failing the type's `pattern`, a malformed value for a type restricting a built-in, or a value invalid against a complex type's simple content is now rejected. The type name is resolved namespace-aware; only a type in the schema's own target namespace is checked (built-ins are handled at structure time; imported, foreign, or inline anonymous types are left alone), and the compiled `SimpleType` validator (the one instance validation uses) performs the check, so whitespace and facet handling match. XSTS: invalid schemas accepted 462 to 454, no other bucket raised.

38
Sources/Schema/SchemaAttributeApplicability.swift
View File

@ -92,27 +92,37 @@ extension PureXML.Schema.XSDParser {
return errors
}
/// A top-level `attribute` declaration (a direct child of `schema`, or of a
/// `redefine`) admits only `default`/`fixed`/`id`/`name`/`type` (the
/// schema-for-schemas `topLevelAttribute`): `use`, `form`, and `ref` belong to a
/// local attribute use, not a global declaration, so they are rejected here. The
/// per-component applicability table is the permissive global/local union and so
/// cannot make this distinction; this scan supplies the global-only constraint.
static func topLevelAttributeErrors(_ schema: XSDTree) -> [String] {
/// A top-level declaration (a direct child of `schema`, or of a `redefine`) is a
/// global component, not a local use, so the attributes that belong only to a
/// local use are rejected: the schema-for-schemas `topLevelAttribute` excludes
/// `use`/`form`/`ref`, and `topLevelElement` excludes `ref`/`form`/`minOccurs`/
/// `maxOccurs` (a global element is a declaration, never a particle or a
/// reference). The per-component applicability table is the permissive
/// global/local union and cannot make this distinction; this scan supplies the
/// global-only constraint.
static func topLevelDeclarationErrors(_ schema: XSDTree) -> [String] {
var errors: [String] = []
collectTopLevelAttributeErrors(in: schema, into: &errors)
collectTopLevelDeclarationErrors(in: schema, into: &errors)
for redefine in PureXML.Schema.XSDNode.elementChildren(schema) {
guard PureXML.Schema.XSDNode.localName(redefine) == "redefine" else { continue }
collectTopLevelAttributeErrors(in: redefine, into: &errors)
collectTopLevelDeclarationErrors(in: redefine, into: &errors)
}
return errors
}
private static func collectTopLevelAttributeErrors(in container: XSDTree, into errors: inout [String]) {
for attribute in PureXML.Schema.XSDNode.elementChildren(container) {
guard PureXML.Schema.XSDNode.localName(attribute) == "attribute", attribute.name?.namespaceURI == xsdNamespace else { continue }
for forbidden in ["use", "form", "ref"] where hasUnprefixed(attribute, forbidden) {
errors.append("a top-level 'attribute' declaration may not specify '\(forbidden)'")
private static let topLevelForbidden: [String: [String]] = [
"attribute": ["use", "form", "ref"],
"element": ["ref", "form", "minOccurs", "maxOccurs"],
]
private static func collectTopLevelDeclarationErrors(in container: XSDTree, into errors: inout [String]) {
for child in PureXML.Schema.XSDNode.elementChildren(container) {
guard child.name?.namespaceURI == xsdNamespace,
let kind = PureXML.Schema.XSDNode.localName(child),
let forbidden = topLevelForbidden[kind]
else { continue }
for attribute in forbidden where hasUnprefixed(child, attribute) {
errors.append("a top-level '\(kind)' declaration may not specify '\(attribute)'")
}
}
}

2
Sources/Schema/SchemaStructure.swift
View File

@ -58,7 +58,7 @@ extension PureXML.Schema.XSDParser {
collectStructure(schema, into: &errors)
errors += simpleTypeVarietyFacetErrors(schema)
errors += valueConstraintErrors(schema)
errors += topLevelAttributeErrors(schema)
errors += topLevelDeclarationErrors(schema)
return errors
}

38
Tests/SchemaTopLevelElementTests.swift Normal file
View File

@ -0,0 +1,38 @@
@testable import PureXML
import Testing
@Suite("XSD top-level element applicability (topLevelElement)")
struct SchemaTopLevelElementTests {
private let xsd = "xmlns:xs=\"http://www.w3.org/2001/XMLSchema\""
private func compiles(_ body: String) -> Bool {
(try? PureXML.Schema.Document("<xs:schema \(xsd)>\(body)</xs:schema>")) != nil
}
@Test("A top-level element with ref/form/minOccurs/maxOccurs is rejected")
func test_topLevelForbiddenRejected() {
#expect(!compiles("<xs:element name=\"g\" type=\"xs:string\"/><xs:element ref=\"g\"/>"))
#expect(!compiles("<xs:element name=\"e\" type=\"xs:string\" form=\"qualified\"/>"))
#expect(!compiles("<xs:element name=\"e\" type=\"xs:string\" minOccurs=\"0\"/>"))
#expect(!compiles("<xs:element name=\"e\" type=\"xs:string\" maxOccurs=\"3\"/>"))
}
@Test("A plain top-level element declaration compiles")
func test_plainTopLevelAccepted() {
#expect(compiles("<xs:element name=\"e\" type=\"xs:string\"/>"))
#expect(compiles("<xs:element name=\"e\" type=\"xs:string\" nillable=\"true\" abstract=\"true\"/>"))
}
/// `ref`, `minOccurs`, and `maxOccurs` are legitimate on a LOCAL element
/// particle inside a complex type; the rule applies only to top-level
/// declarations.
@Test("A local element ref with occurrence compiles")
func test_localParticleAccepted() {
#expect(compiles(
"<xs:element name=\"g\" type=\"xs:string\"/>"
+ "<xs:element name=\"e\"><xs:complexType><xs:sequence>"
+ "<xs:element ref=\"g\" minOccurs=\"0\" maxOccurs=\"3\"/>"
+ "</xs:sequence></xs:complexType></xs:element>",
))
}
}

2
Tests/XSTSSuiteTests.swift
View File

@ -29,7 +29,7 @@ struct XSTSSuiteTests {
/// XSTS` (debug is far slower and the corpus is large). Per-case deviations
/// are written to /tmp/xsts-failures.txt for the burn-down.
private let knownSchemaValidRejected = 1
private let knownSchemaInvalidAccepted = 424
private let knownSchemaInvalidAccepted = 422
private let knownInstanceValidRejected = 180
private let knownInstanceInvalidAccepted = 158

2
docs/schema-validity-burndown.md
View File

@ -10,7 +10,7 @@ irreducible tail. Do not deviate to new features while this is open.
| Bucket | Count | Reading |
|---|---|---|
| valid-schemas-rejected | **72 -> 4** | production target is 0: rejecting a correct schema is the most user-hostile defect (#148). Particle-restriction over-rejection fixed: pointless `maxOccurs=0` particles removed, content-free restriction of an EMPTY base, empty-derived emptiable-base, and (#163) the pairwise check over the normalized content model with occurrence subsumption applied only to same-kind pairings (cross-kind element/group, group/element, group/wildcard match occurrence inside, by effective total range / member). #164 resolved element-ref namespaces by prefix binding (the `particlesJj/Jk/Jm/Jn/Js`, `particlesQ/R` cluster, -28). Content-free (`maxOccurs=0`) derived groups and substitution-group declaration order closed `particlesW006`/`elemZ027_a`; the W3C MapAndSum rule (Sequence:Choice, #165) closed `particlesV003`. Remaining 1 (`particlesZ001`): a documented spec ambiguity (RecurseAsIfGroup; the reference rejects it), not a defect. |
| **invalid-schemas-accepted** | **2461 -> 424** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion landed). |
| **invalid-schemas-accepted** | **2461 -> 422** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion landed). |
| valid-instances-rejected | **233 -> 180** | (instance side; #164's element-ref namespace fix is shared with instance validation, -34) |
| invalid-instances-accepted | **160 -> 158** | (instance side; resolving an inline `<simpleType>` restriction base preserves list/union variety, so a `length` facet counts items and two more invalid instances are caught) |