[jira] Commented: (JCR-517) Reserved status of namespace jcr not enforced.

["Jukka Zitting (JIRA)" <ji...@apache.org>]

    [ http://issues.apache.org/jira/browse/JCR-517?page=comments#action_12440948 ] 
            
Jukka Zitting commented on JCR-517:
-----------------------------------

I was intuitively opposed to the proposed solution, since it reduces the flexibility of the content model. But it seems that this is the least troublesome way to solve the problem. Thus my opinion would be to do this, but only limit the restriction to the jcr namespace (I don't think nt, mix, or xml is used for any critical item).

Are there existing use cases that would be broken if the use of the jcr namespace was restricted?

> Reserved status of namespace jcr not enforced.
> ----------------------------------------------
>
>                 Key: JCR-517
>                 URL: http://issues.apache.org/jira/browse/JCR-517
>             Project: Jackrabbit
>          Issue Type: Bug
>          Components: versioning
>    Affects Versions: 1.0, 1.0.1, 0.9
>            Reporter: Peeter Piegaze
>            Priority: Minor
>
> The failure to enforce the reserved status of the jcr namespace leads to at least one problem.
> A versionable node can be created with properties jcr:frozenPrimaryType, jcr:frozenMixinTypes or jcr:frozenUuid. These clash with the meta-data properties used in the nt:frozenNode. 
> When the versionable is checked-in and then later restored, the corrupt frozen node can cause an exception. The following code demonstrates the problem:
>  
> <code>
>         Repository repository = new TransientRepository();
>         Session session = repository.login(new SimpleCredentials("username", "password".toCharArray()));
>         try {
>             Node root = session.getRootNode();
>             Node a = root.addNode("a", "nt:unstructured");
>             a.addMixin("mix:versionable");
>             a.setProperty("jcr:frozenMixinTypes", new String[]{"x"});
>             session.save();
>             Version v = a.checkin();
>             a.checkout();
>             a.remove();
>             session.save();
>             root.restore(v, "a", true);
>         } finally {
>             session.logout();
>         }
> </code>
> The solution is to enforce the reserved status of jcr (and nt, mix and xml, while we are at it). The rules should be:
> 1) A client cannot register a node type that uses reserved namespaces in either the name of the node type or in the name of any off its child item definitions.
> 2) A client cannot create a residual child item with a name that uses a reserved namespace. Clients can, of course, create an item with a reserved namespace if the item is defined in a built-in JCR node type.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira