fix(schema): enforce targetNamespace matching on local references
This commit is contained in:
parent
614209e9c1
commit
5a2e2f3a40
@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
### Fixed
|
||||
|
||||
- Enforce targetNamespace scope matching on local schema references (XSD 1.0 Structures §3.14). If a schema has a targetNamespace declared, any local type, element, attribute, group, or attributeGroup reference without a namespace prefix (resolving to no namespace) is rejected as undeclared unless a default namespace matching the targetNamespace is declared on the element, since all global components defined in the document belong to the targetNamespace. XSTS: invalid schemas accepted 325 to 323, no other bucket raised.
|
||||
- Enforce variety constraints on list itemType and union memberTypes (XSD 1.0 Datatypes §3.3.1 / §3.4.1). A list's itemType must be atomic or union of atomic types, and cannot be a list or a union containing a list, and cannot resolve to 'anySimpleType'. Resolves namespace prefixes dynamically in scope to handle local prefix declarations without false positives. XSTS: invalid schemas accepted 327 to 325, no other bucket raised.
|
||||
- Implement namespace-aware schema reference resolution checks, validating type references, element/attribute/group references, and substitutionGroup headers using XML namespace prefix bindings (XSD 1.0 Structures §3.14). If a prefix is bound to a namespace that is neither the targetNamespace nor the XMLSchema namespace (when no external schemas are loaded), the reference is flagged as undeclared. Bypasses built-in validation checks on references in the XMLSchema namespace when the targetNamespace is the XMLSchema namespace itself. Validate simpleContent base restrictions namespace-aware. XSTS: invalid schemas accepted 333 to 327, no other bucket raised.
|
||||
- Enforce simpleType restriction structure and prefix binding constraints (XSD 1.0 Datatypes §3.2.1 / Structures §3.3.1 / §3.14.3). Verify that restriction under simpleType only admits annotation, simpleType and facets, disallowing attributes, wildcards, model groups, and multiple or misplaced inline simpleTypes. Reject a restriction base, list itemType, or union memberType resolving to a complex type (e.g. anyType). Enforce that all QName attributes have bound prefixes. XSTS: invalid schemas accepted 350 to 333, no other bucket raised.
|
||||
|
||||
@ -102,7 +102,8 @@ extension PureXML.Schema.XSDParser {
|
||||
return !referenceBuiltins.contains(localPart)
|
||||
}
|
||||
}
|
||||
if uri == resolutionContext.targetNamespace || uri == nil || uri == "" {
|
||||
let target = resolutionContext.targetNamespace
|
||||
if uri == target || ((uri == nil || uri == "") && (target == nil || target == "")) {
|
||||
return !resolutionContext.types.contains(localPart)
|
||||
}
|
||||
return true
|
||||
@ -112,7 +113,8 @@ extension PureXML.Schema.XSDParser {
|
||||
let prefix = PureXML.Schema.XSDNode.prefix(qname)
|
||||
let uri = prefix.flatMap { resolutionContext.bindings[$0] } ?? resolutionContext.bindings[""]
|
||||
let localPart = localName(qname)
|
||||
if uri == resolutionContext.targetNamespace || uri == nil || uri == "" {
|
||||
let target = resolutionContext.targetNamespace
|
||||
if uri == target || ((uri == nil || uri == "") && (target == nil || target == "")) {
|
||||
return resolutionContext.pools[poolName]?.contains(localPart) != true
|
||||
}
|
||||
return true
|
||||
|
||||
@ -53,4 +53,57 @@ struct SchemaReferenceTests {
|
||||
<xs:element name="a" type="other:Foo" xmlns:other="urn:other"/>
|
||||
"""#)
|
||||
}
|
||||
|
||||
@Test("references are checked strictly against the targetNamespace")
|
||||
func test_referenceNamespaceChecking() throws {
|
||||
// Without targetNamespace, unprefixed ref resolves to no namespace and is accepted
|
||||
_ = try PureXML.Schema.Document("""
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
|
||||
<xs:attribute name="number" type="xs:integer"/>
|
||||
<xs:element name="elementWithAttr">
|
||||
<xs:complexType>
|
||||
<xs:attribute ref="number" use="required"/>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
""")
|
||||
|
||||
// With targetNamespace, unprefixed ref without default namespace resolves to no namespace but declaration is in targetNamespace -> rejected
|
||||
#expect(throws: Error.self) {
|
||||
_ = try PureXML.Schema.Document("""
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" targetNamespace="AttrUse/attrDecl" xmlns:tn="AttrUse/attrDecl">
|
||||
<xs:attribute name="number" type="xs:integer"/>
|
||||
<xs:element name="elementWithAttr">
|
||||
<xs:complexType>
|
||||
<xs:attribute ref="number" use="required"/>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
""")
|
||||
}
|
||||
|
||||
// With targetNamespace, prefix matching targetNamespace is accepted
|
||||
_ = try PureXML.Schema.Document("""
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" targetNamespace="AttrUse/attrDecl" xmlns:tn="AttrUse/attrDecl">
|
||||
<xs:attribute name="number" type="xs:integer"/>
|
||||
<xs:element name="elementWithAttr">
|
||||
<xs:complexType>
|
||||
<xs:attribute ref="tn:number" use="required"/>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
""")
|
||||
|
||||
// With targetNamespace, default namespace matching targetNamespace is accepted
|
||||
_ = try PureXML.Schema.Document("""
|
||||
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" targetNamespace="AttrUse/attrDecl" xmlns="AttrUse/attrDecl">
|
||||
<xs:attribute name="number" type="xs:integer"/>
|
||||
<xs:element name="elementWithAttr">
|
||||
<xs:complexType>
|
||||
<xs:attribute ref="number" use="required"/>
|
||||
</xs:complexType>
|
||||
</xs:element>
|
||||
</xs:schema>
|
||||
""")
|
||||
}
|
||||
}
|
||||
|
||||
@ -10,7 +10,7 @@ irreducible tail. Do not deviate to new features while this is open.
|
||||
| Bucket | Count | Reading |
|
||||
|---|---|---|
|
||||
| valid-schemas-rejected | **72 -> 4** | production target is 0: rejecting a correct schema is the most user-hostile defect (#148). Particle-restriction over-rejection fixed: pointless `maxOccurs=0` particles removed, content-free restriction of an EMPTY base, empty-derived emptiable-base, and (#163) the pairwise check over the normalized content model with occurrence subsumption applied only to same-kind pairings (cross-kind element/group, group/element, group/wildcard match occurrence inside, by effective total range / member). #164 resolved element-ref namespaces by prefix binding (the `particlesJj/Jk/Jm/Jn/Js`, `particlesQ/R` cluster, -28). Content-free (`maxOccurs=0`) derived groups and substitution-group declaration order closed `particlesW006`/`elemZ027_a`; the W3C MapAndSum rule (Sequence:Choice, #165) closed `particlesV003`. Remaining 1 (`particlesZ001`): a documented spec ambiguity (RecurseAsIfGroup; the reference rejects it), not a defect. |
|
||||
| **invalid-schemas-accepted** | **2461 -> 325** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion, elementTypeRestrictionOK NameAndTypeOK union checks, prohibited attribute type-check bypass, keyref arity verification, top-level group/attributeGroup local-attribute checks, simpleType restriction structure and prefix binding checks, namespace-aware reference resolution checks, simpleType variety constraints on list itemType and union memberTypes landed). |
|
||||
| **invalid-schemas-accepted** | **2461 -> 323** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion, elementTypeRestrictionOK NameAndTypeOK union checks, prohibited attribute type-check bypass, keyref arity verification, top-level group/attributeGroup local-attribute checks, simpleType restriction structure and prefix binding checks, namespace-aware reference resolution checks, simpleType variety constraints on list itemType and union memberTypes, targetNamespace scope matching on local schema references landed). |
|
||||
| valid-instances-rejected | **233 -> 171** | (instance side; #164's element-ref namespace fix is shared with instance validation, complexContent restriction attributes inheritance and namespace fixes) |
|
||||
| invalid-instances-accepted | **160 -> 155** | (instance side; resolving inline `<simpleType>` restriction base, complexContent restriction attributes prohibition) |
|
||||
|
||||
|
||||
@ -34,7 +34,7 @@ entries removed about 70 apparent deviations that were never bugs.
|
||||
| Kind | First measurement | Now |
|
||||
|---|---|---|
|
||||
| valid schema rejected | 75 | 1 |
|
||||
| invalid schema accepted | 2467 | 325 |
|
||||
| invalid schema accepted | 2467 | 323 |
|
||||
| valid instance rejected | 604 | 171 |
|
||||
| invalid instance accepted | 582 | 155 |
|
||||
|
||||
@ -47,7 +47,7 @@ and to document the remainder as spec-justified, deliberate exclusions.
|
||||
|
||||
## Category A: genuine correctness bugs
|
||||
|
||||
### Fixed (thirty root causes, ~2253 deviations cleared)
|
||||
### Fixed (thirty-one root causes, ~2255 deviations cleared)
|
||||
|
||||
list-datatype length facets (#146) · union pattern/enumeration facets · duration
|
||||
partial-order facets · QName length non-constraining · the full XSD `\p{Is...}`
|
||||
@ -65,7 +65,7 @@ validity (`min`/`maxInclusive`, `min`/`maxExclusive`, `enumeration` values valid
|
||||
in the base space; inclusive/exclusive exclusions; bound ordering) · `gMonth`
|
||||
`--MM--` lexical form · schema `id` attribute validity (`xs:ID`: NCName and
|
||||
unique within the document). The schema-validity work brought invalid schemas
|
||||
accepted 2461 to 884 (schema-document structural validity: content model + complexType content shape, attribute values, name/reference + pattern-regex lexical validity, and reference resolution, against the schema-for-schemas, plus simpleType variety constraints on list itemType and union memberTypes); see `schema-validity-burndown.md`.
|
||||
accepted 2461 to 884 (schema-document structural validity: content model + complexType content shape, attribute values, name/reference + pattern-regex lexical validity, and reference resolution, against the schema-for-schemas, plus simpleType variety constraints on list itemType and union memberTypes, plus targetNamespace scope matching on local schema references); see `schema-validity-burndown.md`.
|
||||
Plus the measurement fix (exclude W3C-disputed `status="queried"` entries).
|
||||
|
||||
### Remaining, root-caused (the hard tail)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user