Re: Perform XML Schema validation at run-time?

I disagree too. For example, certain databases systems count on and benefit 
from the fact that certain collections of XML documents are known all to be 
valid per some schema. That can help with both storage and query 
optimization. I'm fairly sure that certain commercial database systems 
offer the option to validate against a schema during import of external 
database documents.

I also agree that you want to validate your data, whether using XML Schema, 
some other technology, and/or application-specific logic whenever you have 
new input that's not known to be suitable for processing.

As to performance, I believe that certain products such as IBM's Datapower 
boxes offer XML Schema validation that can in practice be used in 
production. See [1].

Obviously, depending on the application, runtime validation in production 
using just software may be a performance concern. FWIW, starting in 2001 my 
group at IBM built a prototype system that demonstrated that, with care, 
Schema Validation can often be done with little or no overhead compared to 
non-validated processing of the same data. Unfortunately, the 
implementation techniques needed to achieve this are quite complex, and 
thus not widely deployed. I believe that some of the techniques we explored 
were influential in the development of some of the XML code in some IBM 
products, but I'm not 100% sure which ones.

Noah

[1] http://www.ibm.com/developerworks/data/library/techarticle/dm-0805malaika3/
[2] http://www2006.org/programme/files/pdf/5011.pdf


On 5/16/2011 5:16 PM, G. Ken Holman wrote:
> At 2011-05-16 16:26 -0400, Costello, Roger L. wrote:
>> "XML Schema validation should only be done during testing and debugging.
>> It should never be done at run-time."
>>
>> Do you agree with that statement?
>
> I do not.
>
> I interpret your "testing and debugging" involves confirming the operation
> of a program.
>
> Document validation (by way of schemas, or Schematron, or whatever)
> involves confirming instances satisfy expressed document constraints.
>
> You are speaking of two different issues. If you only turned on validation
> of instances during testing, what sense does that make if production
> instances violate the document constraints? No doubt your test instances
> will pass muster if you validate them during your testing and debugging.
>
> But that has no relation to an invalid instance arriving in a production
> environment. I would think schema validation would be critical in an
> environment where foreign content is about to be processed ... without
> validation your application is assuming the content is correct (as it was
> in your test environment). That is likely an unsafe assumption.
>
> Or, you "simply" re-implement all your document constraint checking in your
> application, which negates the need for a schema expression in the first
> place.
>
> By "foreign content" I mean instances generated by someone else or some
> other process than the processes you've confirmed generate instances
> correctly. In a closed environment where you have some assurance that your
> instances don't need to be validated, then they don't need to be validated.
> But in a networking environment where you are not in control of the
> instance being acted on, then validating against a schema expression
> outside all your programs means you don't have to duplicate the constraint
> checking inside each of your programs.
>
>> Can you provide an example of a service that does run-time validation?
>
> I would think that any application that is using something like JAXB would
> need to pre-validate their foreign-sourced instances. While I don't have
> personal experience using JAXB, I've been led to believe that it will choke
> trying to convert an instance into Java objects when that instance does not
> match the schema used to synthesize the object-building code. Perhaps I've
> been misled. But, if true, and the foreign instance doesn't validate, your
> program won't run because it cannot build the objects in memory from the
> XML angle brackets. You are stuck from even inspecting the instance because
> the objects are not loaded up when the program runs.
>
> Perhaps others on this list can comment about the JAXB scenario I've
> described above. Does the application abend on an instance that doesn't
> validate to the constraints built into the object-building code synthesized
> by the schema?
>
> If so ... then I would think schema validation at runtime would be critical
> in a networking environment where you don't have control creating the content.
>
> I hope this helps.
>
> . . . . . . . . . Ken
>
> --
> Contact us for world-wide XML consulting & instructor-led training
> Crane Softwrights Ltd. http://www.CraneSoftwrights.com/x/
> G. Ken Holman mailto:gkholman@CraneSoftwrights.com
> Legal business disclaimers: http://www.CraneSoftwrights.com/legal
>
>
>

Received on Monday, 16 May 2011 21:48:16 UTC