W3C home > Mailing lists > Public > www-xml-xinclude-comments@w3.org > December 2004

accept-* attributes improperly defined

From: Bjoern Hoehrmann <derhoermi@gmx.net>
Date: Sat, 11 Dec 2004 06:16:26 +0100
To: www-xml-xinclude-comments@w3.org
Message-ID: <41be80a3.670897781@smtp.bjoern.hoehrmann.de>

Dear XML Core Working Group,

  http://www.w3.org/TR/2004/PR-xinclude-20040930/ in section 3.1 states:

[...]
  accept

    The value of the accept attribute may be used by the XInclude 
    processor to aid in content negotiation. When the XInclude processor
    fetches a resource via HTTP, it should place the value of the accept
    attribute, if one exists, in the HTTP request as an Accept header as
    described in section 14.1 of [IETF RFC 2616]. Values containing
    characters outside the range #x20 through #x7E are disallowed in
    HTTP headers, and must be flagged as fatal errors. 
[...]

The lexical space seems to be unconstrained (it does not say, for
example, that the content must match the respective production rule in
RFC 2616). This makes validation of the accept attribute useless and may
cause illegal HTTP headers to be formed which is highly undesirable.
Please change the specification to clearly define the lexical space of
the attribute value.

The claim in the last sentence is simply false, HTTP headers may contain
characters outside that range, specifically the Accept header allows for
quoted-string tokens which include TEXT tokens which are defined as

  TEXT = <any OCTET except CTLs, but including LWS>

in RFC 2616. Please change the specification to give accurate
information and possibly refine the processing requirements to take into
account that such characters are allowed.

The same comments apply to the definition of the "accept-language"
attribute in the same section of the document.

regards.
-- 
Björn Höhrmann · mailto:bjoern@hoehrmann.de · http://bjoern.hoehrmann.de
Weinh. Str. 22 · Telefon: +49(0)621/4309674 · http://www.bjoernsworld.de
68309 Mannheim · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/ 
Received on Saturday, 11 December 2004 05:16:46 GMT

This archive was generated by hypermail 2.2.0 + w3c-0.30 : Thursday, 9 June 2005 12:16:10 GMT