PureXML/Sources/Schema/SchemaIDAttribute.swift
Mihaela Mihaljevic 7c059e1355 fix(schema): reject circular model-group, attribute-group, and substitution-group references
A model group may not contain itself (mg-props-correct.2), an attribute group
may not reference itself transitively (ag-props-correct.3), and a substitution
chain may not loop (e-props-correct.6).

The model-group check follows references only within a definition's own
compositor tree, stopping at element and type boundaries: a group referenced
inside an element's content is a recursive data structure (permitted), not the
group containing itself (particlesZ010, addB077). A reference is followed only
when it resolves to the schema's own target namespace; a group or attribute
group redefined in xs:redefine ends the chain (its single self-reference is the
legal redefinition).

XSTS: invalid schemas accepted 516 to 505 (attgC010/020/031, attgD015,
groupB012-015, addB180, xsd009.e, xsd010.e now rejected), no other bucket
raised. A genuine cycle introduced across two redefined definitions is a
disclosed under-rejection (an adversarial critic's only finding).
2026-06-15 01:50:35 +02:00

55 lines
3.1 KiB
Swift

extension PureXML.Schema.XSDParser {
/// Schema-validity findings for the `id` attributes in a schema document. The
/// `id` attribute on any XSD component is of type `xs:ID`, so each value must
/// be a valid NCName and all values must be unique within the document
/// (XSD Structures: `xs:ID` and the ID/IDREF constraints). The values were
/// never checked, so a malformed (`id=""`, `id="123"`) or duplicated `id` left
/// the schema wrongly accepted.
///
/// Walks the one document rooted at `schema`; an included or imported document
/// keeps its own `id` scope, so cross-document collisions are not flagged here.
static func idAttributeErrors(_ schema: XSDTree) -> [String] {
var errors: [String] = []
var seen: Set<String> = []
collectIDErrors(schema, into: &errors, seen: &seen)
return errors
}
private static func collectIDErrors(_ node: XSDTree, into errors: inout [String], seen: inout Set<String>) {
// `appinfo` and `documentation` hold arbitrary foreign content whose own
// `id` attributes are not xs:ID; do not descend into them.
let local = PureXML.Schema.XSDNode.localName(node)
if local == "appinfo" || local == "documentation" { return }
if let id = unprefixedID(node) {
if !PureXML.Schema.Lexical.isNCName(id) {
errors.append("id attribute value '\(id)' is not a valid NCName")
} else if !seen.insert(id).inserted {
errors.append("duplicate id attribute value '\(id)' in the schema document")
}
}
for child in PureXML.Schema.XSDNode.elementChildren(node) {
collectIDErrors(child, into: &errors, seen: &seen)
}
}
/// The value of the unprefixed, no-namespace `id` attribute (the xs:ID one),
/// or nil. A prefixed attribute such as `xml:id` or a foreign `pre:id` is a
/// different attribute and is not the schema-component identifier.
private static func unprefixedID(_ node: XSDTree) -> String? {
node.attributes.first { $0.name.prefix == nil && $0.name.localName == "id" }?.value
}
/// All compile-time schema-consistency findings, collected together so they are
/// reported in one pass: `id` validity, schema-for-schemas structure, global
/// component-name uniqueness, content-model determinism (UPA), and circular
/// type derivation. The explicit return type keeps the type-checker from
/// inferring a long concatenation.
static func consistencyErrors(_ schema: XSDTree, _ context: PureXML.Schema.XSDContext, _ containers: [XSDTree]) -> [String] {
let structural = idAttributeErrors(schema) + structureErrors(schema) + componentNameErrors(schema)
let determinism = PureXML.Schema.ContentModelDeterminism.violations(in: schema, context: context)
let cycles = derivationCycleErrors(containers, context.namespaceBindings, context.targetNamespace)
+ circularReferenceErrors(containers, context.namespaceBindings, context.targetNamespace)
return structural + determinism + cycles
}
}