RE: Appropriate XML processing in extensibility consideration (Was rfc2518bis DAV DTD)

> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Stanley Guan
> Sent: Thursday, October 16, 2003 6:47 PM
> To: Julian Reschke; w3c-dist-auth@w3.org
> Subject: Appropriate XML processing in extensibility consideration (Was
> rfc2518bis DAV DTD)
>
>
>
> Julian,
>
> I am getting more clear on what the true issues are.  Thanks!
>
> However, it seems to me that there are different options to resolve the
> extensibility issue and WG seems to choose the following approach:
>
>    1. For client implementations, ignore XML elements they do not
>        understand.
>
>        "Older clients will not break when they encounter extensions
>        because they will still have the data specified in the original
>        schema and will ignore elements they do not understand."

Right.

>    2. For server implementations, ignore any unknown  XML
>        element and all its children encountered.
>
>        "All DAV compliant resources MUST ignore any unknown
>         XML element and all its children encountered while processing
>         a DAV method that uses XML as its command language."
>
>        As told by you, this rule will be extended to include any unknown
>        XML attribute.  Right?

Actually, that's not obvious. RFC2518 so far hasn't used attributes at all
(except for some wording about xml:lang's role). But I'd assume that yes,
extensibility applies to attributes as well.

> To summarize what I understand so far:
>
>     1. WG is seeking a formal notation to describe the XML components
>         contained in any message body that need to be minimally understood
>         by all DAV-compliant (including DAV's extensions) implementations.
>
>         Any bogus (or should be called "alien") XML elements (or
attributes)
>         will be simply ignored without even raising a flag.  So, to avoid
>         hackers using this feature to launch denial-of-access attacks is
to limit
>         the size of XML data allowed in the request body.

Right.

Side note: it would be interesting to explore a mechanism for mandatory
extensions (I think RFC2774 can help here).

>         Additionally, there is no need for any implementation to use any
schema
>         to check whether received XML data is valid or not. What it needs
>         to do is just walking through the XML elements and check if it is
what
>         the implementation can understand or not.   If yes, take action;
>         otherwise, ignore it.

Yes. However, "understanding" is a bit vague. For instance, PROPFIND uses:

<!ELEMENT propfind (allprop | propname | prop) >

So for instance servers SHOULD reject requests such as

<propfind xmlns="DAV:"><prop>...</prop><prop>...</prop></propfind>

>     2. The DAV response header (and new proposed DAV request
>         header is just informational and has no constraining power.

I wouldn't call it "just informational", but it doesn't affect the validaty
of a message body.

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

Received on Thursday, 16 October 2003 15:51:24 UTC