You are viewing a plain text version of this content. The canonical link for it is here.
Posted to c-dev@xerces.apache.org by "Boris Kolpackov (JIRA)" <xe...@xml.apache.org> on 2009/11/18 08:56:39 UTC
[jira] Closed: (XERCESC-1713) external-schemaLocation property does
not override the schema location attribute in the instance
[ https://issues.apache.org/jira/browse/XERCESC-1713?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Boris Kolpackov closed XERCESC-1713.
------------------------------------
Resolution: Fixed
Fix Version/s: 3.1.0
The fix is in SVN. This can now be resolved by setting fgXercesLoadSchema property to false.
> external-schemaLocation property does not override the schema location attribute in the instance
> ------------------------------------------------------------------------------------------------
>
> Key: XERCESC-1713
> URL: https://issues.apache.org/jira/browse/XERCESC-1713
> Project: Xerces-C++
> Issue Type: Bug
> Components: Validating Parser (XML Schema)
> Affects Versions: 2.7.0
> Environment: any
> Reporter: Boris Kolpackov
> Fix For: 3.1.0
>
>
> The documentation for the external-schemaLocation and external-noNamespaceSchemaLocation properties state that if specified, the instance document's schemaLocation and noNamespaceSchemaLocation attributes will be effectively ignored. This appears not to be the case. If the schema specified with the external-* properies can not be opened, the parser proceeds to try paths from the schemaLocation and noNamespaceSchemaLocation attributes. I think this does not make much sense and is actually a potential security threat. Normally if one specifies the schema location with the external-* properties they don't want the values from the instance to have any effect.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: c-dev-unsubscribe@xerces.apache.org
For additional commands, e-mail: c-dev-help@xerces.apache.org