[jira] [Commented] (DAFFODIL-602) Setting to prevent off-box access to schemas

["Mike Beckerle (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/DAFFODIL-602?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17113266#comment-17113266 ] 

Mike Beckerle commented on DAFFODIL-602:
----------------------------------------

See also: https://docs.oracle.com/javase/tutorial/jaxp/properties/properties.html which describes new properties in the JAXP controlling whether external references can be retrieved or not. 

> Setting to prevent off-box access to schemas
> --------------------------------------------
>
>                 Key: DAFFODIL-602
>                 URL: https://issues.apache.org/jira/browse/DAFFODIL-602
>             Project: Daffodil
>          Issue Type: New Feature
>          Components: API, Front End
>    Affects Versions: s8
>            Reporter: Mike Beckerle
>            Priority: Major
>
> For many DFDL applications this is a must-have capability. 
> Systems whose job is to scrutinize data carefully must have a controlled base of DFDL schemas that are well trusted. 
> Reaching out the internet to get schemas is definitely unacceptable for these applications.
> As for how to test this.... keep in mind that just disconnecting a test box from the internet won't do it. A test might not fail just because a probe for a schema on the internet failed. It might behave in some different manner if it is unable to successfully reach the internet, yet still be making the attempts. The requirement here is that it not even be attempting to contact the internet to get schemas.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)