Re: Should we say anything on security?

On Tue, Sep 11, 2012 at 11:56 PM, James Clark <jjc@jclark.com> wrote:

> On Wed, Sep 12, 2012 at 12:37 PM, Liam R E Quin <liam@w3.org> wrote:
>
>  >  We can also say that another factor that may make
>> > it more suitable for protocols is that it allows you to follow the
>> > long-standing IETF tradition of being liberal in what you accept.
>>
>> I'm reluctant there. XML doesn't forbid error recovery either - it only
>> forbids *silent* error recovery. If a document isn't XML you can't claim
>> it's XML, but you can turn it into XML and process the result.
>>
>
> The XML Rec says (in the definition of fatal error):
>
> Once a fatal error is detected, however, the processor must not continue
>> normal processing (i.e., it must notcontinue to pass character data and
>> information about the document's logical structure to the application in
>> the normal way)
>
>
> The way I've interpreted this (which I think it s reasonable) is that the
> parser must not continue to pass start-/end-element/character data events
> to the application after it has seen a well-formedness error.
>

I think this is the way almost every implementor has interpreted it as
well.  Some, such as libxml will take advantage of the "in a normal way"
clause to at least try to show the user any further fatal errors beyond the
first, to make fix-up a bit less painful, but yeah that hardly counts as
liberal acceptance, and anyway most parsers do stop dead at the first fatal
error.


-- 
Uche Ogbuji                       http://uche.ogbuji.net
Founding Partner, Zepheira        http://zepheira.com
http://wearekin.org
http://www.thenervousbreakdown.com/author/uogbuji/
http://copia.ogbuji.net
http://www.linkedin.com/in/ucheogbuji
http://twitter.com/uogbuji