diff --git a/CHANGELOG.md b/CHANGELOG.md index 6a83723..8e1e2bb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed +- A top-level `xs:attribute` declaration may no longer carry `use`, `form`, or `ref` (XSD 1.0 schema-for-schemas `topLevelAttribute`, #170). Those belong to a local attribute use, not a global declaration; the per-component applicability table is the permissive global/local union and so could not draw the distinction, leaving such schemas accepted. A focused scan of the direct `attribute` children of `schema` (and of `redefine`) supplies the global-only constraint; a local attribute use inside a complex type or attribute group is unaffected. XSTS: invalid schemas accepted 454 to 439, no other bucket raised. - A `default`/`fixed` value on an element or attribute whose `type` names a user-declared type must now be a valid value of that type (XSD 1.0 `e-props-correct.2` / `a-props-correct.2`, #170). This runs after the named types are compiled, complementing the existing built-in-only check: a `default` failing the type's `pattern`, a malformed value for a type restricting a built-in, or a value invalid against a complex type's simple content is now rejected. The type name is resolved namespace-aware; only a type in the schema's own target namespace is checked (built-ins are handled at structure time; imported, foreign, or inline anonymous types are left alone), and the compiled `SimpleType` validator (the one instance validation uses) performs the check, so whitespace and facet handling match. XSTS: invalid schemas accepted 462 to 454, no other bucket raised. - A simple-type `restriction` whose base is an inline anonymous `` (no `base` attribute) now resolves that inline child as its base, preserving its list or union variety. The base was read only from the `base` attribute, so an inline list/union base was dropped and the type collapsed to an atomic string: a `length` facet then counted characters instead of list items, and a list-valued `default` of the correct length was wrongly rejected once value constraints are checked. Resolving the inline base fixes both schema-time value checking and instance validation. XSTS: invalid instances accepted 160 to 158, no other bucket raised. - An `xs:attribute` declaration carrying a `default` value constraint must now have `use="optional"` (XSD 1.0 `src-attribute.2`, #170). A default makes the attribute optional, so `use="required"` or `use="prohibited"` alongside it is contradictory; such schemas were accepted. The check rides the existing value-constraint walk, gated to XSD-namespace `attribute` declarations reading the unprefixed `default`/`use`, and is per declaration. Only `fixed` (not `default`) may pair with `use="required"`. XSTS: invalid schemas accepted 469 to 462, no other bucket raised. Disclosed under-rejection: a whitespace-padded `use=" required "` (whose NMTOKEN actual value is `required`) is not flagged. diff --git a/Sources/Schema/SchemaAttributeApplicability.swift b/Sources/Schema/SchemaAttributeApplicability.swift index 41ca92d..8a9aa5e 100644 --- a/Sources/Schema/SchemaAttributeApplicability.swift +++ b/Sources/Schema/SchemaAttributeApplicability.swift @@ -78,6 +78,35 @@ extension PureXML.Schema.XSDParser { return errors } + /// A top-level `attribute` declaration (a direct child of `schema`, or of a + /// `redefine`) admits only `default`/`fixed`/`id`/`name`/`type` (the + /// schema-for-schemas `topLevelAttribute`): `use`, `form`, and `ref` belong to a + /// local attribute use, not a global declaration, so they are rejected here. The + /// per-component applicability table is the permissive global/local union and so + /// cannot make this distinction; this scan supplies the global-only constraint. + static func topLevelAttributeErrors(_ schema: XSDTree) -> [String] { + var errors: [String] = [] + collectTopLevelAttributeErrors(in: schema, into: &errors) + for redefine in PureXML.Schema.XSDNode.elementChildren(schema) { + guard PureXML.Schema.XSDNode.localName(redefine) == "redefine" else { continue } + collectTopLevelAttributeErrors(in: redefine, into: &errors) + } + return errors + } + + private static func collectTopLevelAttributeErrors(in container: XSDTree, into errors: inout [String]) { + for attribute in PureXML.Schema.XSDNode.elementChildren(container) { + guard PureXML.Schema.XSDNode.localName(attribute) == "attribute", attribute.name?.namespaceURI == xsdNamespace else { continue } + for forbidden in ["use", "form", "ref"] where hasUnprefixed(attribute, forbidden) { + errors.append("a top-level 'attribute' declaration may not specify '\(forbidden)'") + } + } + } + + private static func hasUnprefixed(_ node: XSDTree, _ local: String) -> Bool { + node.attributes.contains { $0.name.prefix == nil && $0.name.localName == local } + } + private static func hasInlineType(_ node: XSDTree, _ local: String) -> Bool { PureXML.Schema.XSDNode.elementChildren(node).contains { child in // Only an inline type in the XSD namespace counts; a foreign-namespace diff --git a/Sources/Schema/SchemaStructure.swift b/Sources/Schema/SchemaStructure.swift index 6db26fc..71fd2f6 100644 --- a/Sources/Schema/SchemaStructure.swift +++ b/Sources/Schema/SchemaStructure.swift @@ -58,6 +58,7 @@ extension PureXML.Schema.XSDParser { collectStructure(schema, into: &errors) errors += simpleTypeVarietyFacetErrors(schema) errors += valueConstraintErrors(schema) + errors += topLevelAttributeErrors(schema) return errors } diff --git a/Tests/SchemaStructureTests.swift b/Tests/SchemaStructureTests.swift index f47f5c2..4b954de 100644 --- a/Tests/SchemaStructureTests.swift +++ b/Tests/SchemaStructureTests.swift @@ -106,7 +106,8 @@ struct SchemaStructureTests { @Test("valid enumerated and occurrence attribute values compile") func test_validAttributeValues() throws { - try compile(#""#) + // `use` is valid on a local attribute use, not on a top-level declaration. + try compile(#""#) try compile(#""#) try compile(#""#) } diff --git a/Tests/SchemaTopLevelAttributeTests.swift b/Tests/SchemaTopLevelAttributeTests.swift new file mode 100644 index 0000000..786fc4e --- /dev/null +++ b/Tests/SchemaTopLevelAttributeTests.swift @@ -0,0 +1,47 @@ +@testable import PureXML +import Testing + +@Suite("XSD top-level attribute applicability (topLevelAttribute)") +struct SchemaTopLevelAttributeTests { + private let xsd = "xmlns:xs=\"http://www.w3.org/2001/XMLSchema\"" + + private func compiles(_ body: String) -> Bool { + (try? PureXML.Schema.Document("\(body)")) != nil + } + + @Test("A top-level attribute with use is rejected") + func test_topLevelUseRejected() { + #expect(!compiles("")) + #expect(!compiles("")) + #expect(!compiles("")) + } + + @Test("A top-level attribute with form is rejected") + func test_topLevelFormRejected() { + #expect(!compiles("")) + } + + @Test("A plain top-level attribute declaration compiles") + func test_plainTopLevelAccepted() { + #expect(compiles("")) + #expect(compiles("")) + } + + /// `use`, `form`, and a `ref` are legitimate on a LOCAL attribute use inside a + /// complex type; the rule applies only to top-level declarations. + @Test("A local attribute use with use/form compiles") + func test_localUseAccepted() { + #expect(compiles( + "" + + "" + + "", + )) + // A local ref with use is fine. + #expect(compiles( + "" + + "" + + "" + + "", + )) + } +} diff --git a/Tests/XSTSSuiteTests.swift b/Tests/XSTSSuiteTests.swift index 5418a68..8d793f2 100644 --- a/Tests/XSTSSuiteTests.swift +++ b/Tests/XSTSSuiteTests.swift @@ -29,7 +29,7 @@ struct XSTSSuiteTests { /// XSTS` (debug is far slower and the corpus is large). Per-case deviations /// are written to /tmp/xsts-failures.txt for the burn-down. private let knownSchemaValidRejected = 1 - private let knownSchemaInvalidAccepted = 454 + private let knownSchemaInvalidAccepted = 439 private let knownInstanceValidRejected = 180 private let knownInstanceInvalidAccepted = 158 diff --git a/docs/schema-validity-burndown.md b/docs/schema-validity-burndown.md index 3e4c330..d598def 100644 --- a/docs/schema-validity-burndown.md +++ b/docs/schema-validity-burndown.md @@ -10,7 +10,7 @@ irreducible tail. Do not deviate to new features while this is open. | Bucket | Count | Reading | |---|---|---| | valid-schemas-rejected | **72 -> 4** | production target is 0: rejecting a correct schema is the most user-hostile defect (#148). Particle-restriction over-rejection fixed: pointless `maxOccurs=0` particles removed, content-free restriction of an EMPTY base, empty-derived emptiable-base, and (#163) the pairwise check over the normalized content model with occurrence subsumption applied only to same-kind pairings (cross-kind element/group, group/element, group/wildcard match occurrence inside, by effective total range / member). #164 resolved element-ref namespaces by prefix binding (the `particlesJj/Jk/Jm/Jn/Js`, `particlesQ/R` cluster, -28). Content-free (`maxOccurs=0`) derived groups and substitution-group declaration order closed `particlesW006`/`elemZ027_a`; the W3C MapAndSum rule (Sequence:Choice, #165) closed `particlesV003`. Remaining 1 (`particlesZ001`): a documented spec ambiguity (RecurseAsIfGroup; the reference rejects it), not a defect. | -| **invalid-schemas-accepted** | **2461 -> 454** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion landed). | +| **invalid-schemas-accepted** | **2461 -> 439** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion landed). | | valid-instances-rejected | **233 -> 180** | (instance side; #164's element-ref namespace fix is shared with instance validation, -34) | | invalid-instances-accepted | **160 -> 158** | (instance side; resolving an inline `` restriction base preserves list/union variety, so a `length` facet counts items and two more invalid instances are caught) |