XML Schema Resolver proposal

["David E. Cleary" <da...@progress.com>]

Currently it is a requirement to use xsi:schemaLocation and
xsi:noNamespaceSchemaLocation in your XML instance data in order to get
Xerces to do schema validation. The XML Schema Recommendation explicitly
states that the inclusion of these attributes are only hints and there is no
mandate that these attributes must be used. This is due to the fact that
there are many use cases where you do not want to trust the instance data to
validate itself, which is effectively what you are doing. For instance, in
server side applications it is reasonable that all valid XML instances your
application processes will have a schema that is stored locally to the
system which has been verified and is trusted.

Therefore, I propose that a Schema Resolver be created that works much like
an Entity Resolver works today. An application would first disable use of
xsi:schemaLocation and xsi:noNamespaceSchemaLocation so that schemas will
not be automatically retrieved if the instance contains these attributes.
Next, the application instantiates and registers an object that implements
the SchemaResolver interface. This interface has a single method with the
following signature:

    InputSource* resolveSchema
    (
        const   XMLCh* const    namespaceURI
        , const XMLCh* const    schemaLocation
    );

namespaceURI is the URI for the namespace that was declared and
schemaLocation is the URL, if any, that was provided by the
xsi:schemaLocation attribute for that particular namespace, if present.
Otherwise, it is null.

As the parser processes the instance document, resolveSchema will be called
for every namespace declaration declared in the instance, unless a schema
for that namespace has already be resolved. The method returns either an
InputSource for a schema that defines that namespace, or null.

As an alternative, overloading EntityResolver for this purpose is also an
option. Personally, I believe that a namespace URI maps to a Public
Identifier, and schemaLocation maps to a System Identifier, but that view is
not shared by all. In any case, Xerces can not rely solely on
xsi:schemaLocation to find and resolve schemas for validating instances.

David Cleary
the Progress Company


---------------------------------------------------------------------
To unsubscribe, e-mail: xerces-c-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xerces-c-dev-help@xml.apache.org