feat(schema): enforce simpleType final for list and union derivation (st-props-correct)
A simple type whose final contains list (or #all) may not be a list itemType, and one whose final contains union (or #all) may not be a union memberType. finalRespected already covered restriction and extension; the list and union directions were unchecked because the derivation-method set does not model final="list"/"union", so the final attribute is read directly. The itemType / memberTypes reference is matched only when it resolves to the schema's own target namespace, so a list or union of a built-in (whose final is empty) is not confused with a user type of the same local name. Checked for a self-contained schema. XSTS: invalid schemas accepted 413 to 411, no other bucket raised.
This commit is contained in:
parent
fbcfe758a5
commit
ca1a7bdf3f
@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
### Fixed
|
||||
|
||||
- A simple type whose `final` contains `list` (or `#all`) may no longer be used as a list `itemType`, and one whose `final` contains `union` (or `#all`) may no longer be a union `memberType` (XSD 1.0 simple-type `final`, #170). The restriction and extension directions were already enforced by `finalRespected`; the list and union directions were unchecked because `final="list"`/`"union"` is not modelled by the derivation-method set, so the `final` attribute is read directly. The reference is matched only when it resolves to the schema's own target namespace, so a list or union of a built-in (whose final is empty) is not confused with a user type of the same local name. Checked for a self-contained schema. XSTS: invalid schemas accepted 413 to 411, no other bucket raised.
|
||||
- A `whiteSpace` facet may only strengthen, never relax, its base type's effective whiteSpace (XSD Part 2 §4.3.6, #170). The order is `preserve` < `replace` < `collapse`, so a base fixed to `collapse` admits only `collapse`, and a `replace` base admits `replace` or `collapse`. A derivation that relaxes it (for example `whiteSpace="replace"` over a `collapse` base, or restricting `xs:token` to `replace`) was accepted and is now rejected. The base's effective whiteSpace is its own facet, falling back to its built-in intrinsic; the check is atomic-only and, when a base type's own whiteSpace has not yet resolved, can only under-detect, never reject a valid restriction. XSTS: invalid schemas accepted 422 to 413, no other bucket raised.
|
||||
- A top-level `xs:element` declaration may no longer carry `ref`, `form`, `minOccurs`, or `maxOccurs` (XSD 1.0 schema-for-schemas `topLevelElement`, #170). A global element is a declaration, never a particle or a reference, so those local-use attributes are invalid. The top-level-attribute applicability scan added earlier is generalized to cover both kinds; a local element particle inside a content model is unaffected. XSTS: invalid schemas accepted 424 to 422, no other bucket raised.
|
||||
- An element `ref` may no longer carry `nillable`, `default`, `fixed`, `form`, or `block`, and an element or attribute `ref` may no longer have an inline type definition (XSD 1.0 `src-element.2.2`, #170). A reference is a use of a global declaration, not a declaration, so beyond `ref` it carries only `minOccurs`, `maxOccurs`, and `id`; the applicability check already excluded `name` and `type` from a `ref`, and this extends the exclusion to the remaining declaration-only properties. A `group`/`attributeGroup` ref and an attribute ref's `use`/`default`/`fixed` (which override on the use) are unaffected. XSTS: invalid schemas accepted 439 to 424, no other bucket raised. Disclosed under-detection: a `key`/`unique`/`keyref` child under a ref is not yet flagged.
|
||||
|
||||
@ -46,6 +46,7 @@ extension PureXML.Schema.XSDParser {
|
||||
/// inferring a long concatenation.
|
||||
static func consistencyErrors(_ schema: XSDTree, _ context: PureXML.Schema.XSDContext, _ containers: [XSDTree]) -> [String] {
|
||||
let structural = idAttributeErrors(schema) + structureErrors(schema) + componentNameErrors(schema)
|
||||
+ simpleTypeFinalErrors(schema)
|
||||
let determinism = PureXML.Schema.ContentModelDeterminism.violations(in: schema, context: context)
|
||||
let cycles = derivationCycleErrors(containers, context.namespaceBindings, context.targetNamespace)
|
||||
+ circularReferenceErrors(containers, context.namespaceBindings, context.targetNamespace)
|
||||
|
||||
81
Sources/Schema/SchemaSimpleTypeFinal.swift
Normal file
81
Sources/Schema/SchemaSimpleTypeFinal.swift
Normal file
@ -0,0 +1,81 @@
|
||||
private typealias FinalNode = PureXML.Schema.XSDNode
|
||||
|
||||
extension PureXML.Schema.XSDParser {
|
||||
/// XSD 1.0 simple-type `final` enforcement for the list and union derivation
|
||||
/// directions (`st-props-correct` / Derivation Valid): a simple type whose
|
||||
/// `final` contains `list` may not be the `itemType` of a list, and one whose
|
||||
/// `final` contains `union` may not be a `memberType` of a union (`#all` forbids
|
||||
/// both, along with `restriction`). The restriction and extension directions are
|
||||
/// already enforced by `finalRespected`; the list and union directions were
|
||||
/// unchecked because `final="list"`/`"union"` is not modelled by
|
||||
/// `DerivationMethod`, so the `final` attribute is read directly here.
|
||||
///
|
||||
/// Checked only for a self-contained schema (no `import`/`include`/`redefine`),
|
||||
/// where the single target namespace makes the names resolved by local name
|
||||
/// unambiguous; with external definitions the check stands down (a disclosed
|
||||
/// under-rejection).
|
||||
static func simpleTypeFinalErrors(_ schema: XSDTree) -> [String] {
|
||||
guard !hasExternalReference(schema) else { return [] }
|
||||
let finalOf = simpleTypeFinalMap(schema)
|
||||
guard finalOf.values.contains(where: { !$0.isEmpty }) else { return [] }
|
||||
// The `final` map is keyed by local name; an `itemType`/`memberTypes`
|
||||
// reference must resolve to this schema's own target namespace before it is
|
||||
// matched, so a reference to a built-in (for example `xs:string`) is never
|
||||
// confused with a user type of the same local name.
|
||||
let bindings = FinalNode.namespaceBindings(of: schema)
|
||||
let target = FinalNode.attribute(schema, "targetNamespace")
|
||||
return listItemFinalErrors(schema, finalOf, bindings, target)
|
||||
+ unionMemberFinalErrors(schema, finalOf, bindings, target)
|
||||
}
|
||||
|
||||
/// Each named simple type mapped to the derivation tokens its `final` forbids.
|
||||
private static func simpleTypeFinalMap(_ schema: XSDTree) -> [String: Set<String>] {
|
||||
var finalOf: [String: Set<String>] = [:]
|
||||
for simpleType in descendants(schema, named: "simpleType") {
|
||||
guard let name = FinalNode.attribute(simpleType, "name") else { continue }
|
||||
finalOf[name] = finalTokens(FinalNode.attribute(simpleType, "final"))
|
||||
}
|
||||
return finalOf
|
||||
}
|
||||
|
||||
private static func listItemFinalErrors(_ schema: XSDTree, _ finalOf: [String: Set<String>], _ bindings: [String: String], _ target: String?) -> [String] {
|
||||
var errors: [String] = []
|
||||
for list in descendants(schema, named: "list") {
|
||||
guard let item = FinalNode.attribute(list, "itemType"),
|
||||
FinalNode.referenceNamespace(item, bindings) == target
|
||||
else { continue }
|
||||
let name = FinalNode.stripPrefix(item)
|
||||
if finalOf[name]?.contains("list") == true {
|
||||
errors.append("simple type '\(name)' is final for 'list' and may not be a list item type")
|
||||
}
|
||||
}
|
||||
return errors
|
||||
}
|
||||
|
||||
private static func unionMemberFinalErrors(_ schema: XSDTree, _ finalOf: [String: Set<String>], _ bindings: [String: String], _ target: String?) -> [String] {
|
||||
var errors: [String] = []
|
||||
for union in descendants(schema, named: "union") {
|
||||
guard let members = FinalNode.attribute(union, "memberTypes") else { continue }
|
||||
for token in members.split(whereSeparator: \.isWhitespace) {
|
||||
guard FinalNode.referenceNamespace(String(token), bindings) == target else { continue }
|
||||
let name = FinalNode.stripPrefix(String(token))
|
||||
if finalOf[name]?.contains("union") == true {
|
||||
errors.append("simple type '\(name)' is final for 'union' and may not be a union member type")
|
||||
}
|
||||
}
|
||||
}
|
||||
return errors
|
||||
}
|
||||
|
||||
/// The derivation tokens a `final` value forbids; `#all` forbids every simple-type
|
||||
/// derivation (`restriction`, `list`, `union`).
|
||||
private static func finalTokens(_ raw: String?) -> Set<String> {
|
||||
guard let raw, !raw.isEmpty else { return [] }
|
||||
var tokens: Set<String> = []
|
||||
for token in raw.split(whereSeparator: \.isWhitespace) {
|
||||
if token == "#all" { return ["restriction", "list", "union"] }
|
||||
tokens.insert(String(token))
|
||||
}
|
||||
return tokens
|
||||
}
|
||||
}
|
||||
64
Tests/SchemaSimpleTypeFinalTests.swift
Normal file
64
Tests/SchemaSimpleTypeFinalTests.swift
Normal file
@ -0,0 +1,64 @@
|
||||
@testable import PureXML
|
||||
import Testing
|
||||
|
||||
@Suite("XSD simple-type final: list/union derivation (st-props-correct)")
|
||||
struct SchemaSimpleTypeFinalTests {
|
||||
private let xsd = "xmlns:xs=\"http://www.w3.org/2001/XMLSchema\""
|
||||
|
||||
private func compiles(_ body: String) -> Bool {
|
||||
(try? PureXML.Schema.Document("<xs:schema \(xsd)>\(body)</xs:schema>")) != nil
|
||||
}
|
||||
|
||||
private func base(_ final: String) -> String {
|
||||
"<xs:simpleType name=\"T\" final=\"\(final)\"><xs:restriction base=\"xs:string\"/></xs:simpleType>"
|
||||
}
|
||||
|
||||
private let listOfT = "<xs:simpleType name=\"L\"><xs:list itemType=\"T\"/></xs:simpleType>"
|
||||
private let unionOfT = "<xs:simpleType name=\"U\"><xs:union memberTypes=\"T\"/></xs:simpleType>"
|
||||
|
||||
@Test("A type final for 'list' may not be a list item type")
|
||||
func test_finalListRejected() {
|
||||
#expect(!compiles(base("list") + listOfT))
|
||||
#expect(!compiles(base("#all") + listOfT))
|
||||
}
|
||||
|
||||
@Test("A type final for 'union' may not be a union member type")
|
||||
func test_finalUnionRejected() {
|
||||
#expect(!compiles(base("union") + unionOfT))
|
||||
#expect(!compiles(base("#all") + unionOfT))
|
||||
}
|
||||
|
||||
@Test("final restricts only the named direction")
|
||||
func test_finalDirectionScoped() {
|
||||
// final='list' does not forbid being a union member.
|
||||
#expect(compiles(base("list") + unionOfT))
|
||||
// final='union' does not forbid being a list item.
|
||||
#expect(compiles(base("union") + listOfT))
|
||||
// final='restriction' forbids neither list nor union derivation.
|
||||
#expect(compiles(base("restriction") + listOfT))
|
||||
#expect(compiles(base("restriction") + unionOfT))
|
||||
}
|
||||
|
||||
@Test("A type with no final is usable in a list or union")
|
||||
func test_noFinalAccepted() {
|
||||
let plain = "<xs:simpleType name=\"T\"><xs:restriction base=\"xs:string\"/></xs:simpleType>"
|
||||
#expect(compiles(plain + listOfT))
|
||||
#expect(compiles(plain + unionOfT))
|
||||
}
|
||||
|
||||
/// A user type sharing a built-in's local name (here `string`, `final="list"`)
|
||||
/// must not be confused with a reference to the built-in `xs:string`: a list of
|
||||
/// `xs:string` is valid because the built-in's final is empty. The reference is
|
||||
/// matched only when it resolves to the schema's own namespace.
|
||||
@Test("A built-in itemType is not confused with a same-named final user type")
|
||||
func test_builtinNameNotConfused() {
|
||||
#expect(compiles(
|
||||
"<xs:simpleType name=\"string\" final=\"list\"><xs:restriction base=\"xs:string\"/></xs:simpleType>"
|
||||
+ "<xs:simpleType name=\"L\"><xs:list itemType=\"xs:string\"/></xs:simpleType>",
|
||||
))
|
||||
#expect(compiles(
|
||||
"<xs:simpleType name=\"string\" final=\"union\"><xs:restriction base=\"xs:string\"/></xs:simpleType>"
|
||||
+ "<xs:simpleType name=\"U\"><xs:union memberTypes=\"xs:string\"/></xs:simpleType>",
|
||||
))
|
||||
}
|
||||
}
|
||||
@ -29,7 +29,7 @@ struct XSTSSuiteTests {
|
||||
/// XSTS` (debug is far slower and the corpus is large). Per-case deviations
|
||||
/// are written to /tmp/xsts-failures.txt for the burn-down.
|
||||
private let knownSchemaValidRejected = 1
|
||||
private let knownSchemaInvalidAccepted = 413
|
||||
private let knownSchemaInvalidAccepted = 411
|
||||
private let knownInstanceValidRejected = 180
|
||||
private let knownInstanceInvalidAccepted = 158
|
||||
|
||||
|
||||
@ -10,7 +10,7 @@ irreducible tail. Do not deviate to new features while this is open.
|
||||
| Bucket | Count | Reading |
|
||||
|---|---|---|
|
||||
| valid-schemas-rejected | **72 -> 4** | production target is 0: rejecting a correct schema is the most user-hostile defect (#148). Particle-restriction over-rejection fixed: pointless `maxOccurs=0` particles removed, content-free restriction of an EMPTY base, empty-derived emptiable-base, and (#163) the pairwise check over the normalized content model with occurrence subsumption applied only to same-kind pairings (cross-kind element/group, group/element, group/wildcard match occurrence inside, by effective total range / member). #164 resolved element-ref namespaces by prefix binding (the `particlesJj/Jk/Jm/Jn/Js`, `particlesQ/R` cluster, -28). Content-free (`maxOccurs=0`) derived groups and substitution-group declaration order closed `particlesW006`/`elemZ027_a`; the W3C MapAndSum rule (Sequence:Choice, #165) closed `particlesV003`. Remaining 1 (`particlesZ001`): a documented spec ambiguity (RecurseAsIfGroup; the reference rejects it), not a defect. |
|
||||
| **invalid-schemas-accepted** | **2461 -> 413** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion landed). |
|
||||
| **invalid-schemas-accepted** | **2461 -> 411** | we rarely catch a bad one (facet, default/fixed value, particle-restriction name+type, id, structural content-model, UPA determinism, content order, identity-constraint XPath-subset, wildcard-namespace, final/block, simpleType content, group/wildcard and group/element cardinality, element-ref namespace, sequence/choice MapAndSum, circular type derivation, circular group/attributeGroup/substitution references, attribute-use uniqueness and single-ID, type-excludes-inline-type, ID-typed value-constraint exclusion, all-group reference placement, substitution-member type derivation, default/fixed mutual exclusion landed). |
|
||||
| valid-instances-rejected | **233 -> 180** | (instance side; #164's element-ref namespace fix is shared with instance validation, -34) |
|
||||
| invalid-instances-accepted | **160 -> 158** | (instance side; resolving an inline `<simpleType>` restriction base preserves list/union variety, so a `length` facet counts items and two more invalid instances are caught) |
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user