Xerces-C 2.6

[Jesse Pelton <js...@PKC.com>]

The March 2004 news item at http://xml.apache.org/security/c/index.html
indicates that version 1.1 of the C++ library supports Xerces-C 2.3 -
2.5.  Is it known whether Xerces-C 2.6 is supported?

RE: Xerces-C 2.6

[Scott Cantor <ca...@osu.edu>]

> The March 2004 news item at 
> http://xml.apache.org/security/c/index.html
> indicates that version 1.1 of the C++ library supports Xerces-C 2.3 -
> 2.5.  Is it known whether Xerces-C 2.6 is supported?

It works, to some extent, but the change to base64 validation in 2.6 makes
super-signatures impossible to use because data type normalization generally
has to be off for that to work at all. That causes the base64 type validator
to fail because of line feeds that haven't been normalized out.

In other words, the combination is unsable in many contexts. I had to
produce a Xerces 2.6.1 version for my project that disables the schema
"mode" for base64 validation, because I needed other XSD patches from 2.6.

So as a user of both I'd say for practical purposes, no, it's not
supportable and won't be until the base64 change is reversed in the interest
of usability.

-- Scott