Bug: delegateURI and delegateSystem with the same URL cause a bug in the resolver

--=-OVv1YbIc2eNwTB1qiTOv
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit

I'm not subscribed to the list, so please CC me if you need more
information

Hi,

For the long report read Debian bug#552018:
http://bugs.debian.org/552018

Say a catalog contains two entries delegateSystem and delegateURI
rewriting the same URL. Then the resolver fails to work correctly. It
strongly depends on the order in the catalog if the URI gets resolved.
Consider the attached testcase:

java -cp /usr/share/java/xml-commons-resolver-1.1.jar:. \
  org.apache.xml.resolver.apps.resolver -u http://invalid.invalid uri
> Parse catalog: catalog1.xml
> Loading catalog: catalog1.xml
> Default BASE: file:////usr/local/src/bugs/552018/catalog1.xml
> delegateSystem: http://invalid.invalid
> 	catalog2.xml
> DELEGATE_SYSTEM: http://invalid.invalid
> 	file:////usr/local/src/bugs/552018/catalog2.xml
> delegateURI: http://invalid.invalid
> 	catalog2.xml
> DELEGATE_URI: http://invalid.invalid
> 	file:////usr/local/src/bugs/552018/catalog2.xml
> Resolve URI (uri):
>         uri: http://invalid.invalid
> resolveURI(http://invalid.invalid)
> Result: null

Why doesn't it select the delegateURI entry? Now this:

java -cp /usr/share/java/xml-commons-resolver-1.1.jar:. \
  org.apache.xml.resolver.apps.resolver -s http://invalid.invalid system
> Parse catalog: catalog1.xml
> Loading catalog: catalog1.xml
> Default BASE: file:////usr/local/src/bugs/552018/catalog1.xml
> delegateSystem: http://invalid.invalid
> 	catalog2.xml
> DELEGATE_SYSTEM: http://invalid.invalid
> 	file:////usr/local/src/bugs/552018/catalog2.xml
> delegateURI: http://invalid.invalid
> 	catalog2.xml
> DELEGATE_URI: http://invalid.invalid
> 	file:////usr/local/src/bugs/552018/catalog2.xml
> Resolve SYSTEM (systemid):
>   system id: http://invalid.invalid
> resolveSystem(http://invalid.invalid)
> Switching to delegated catalog(s):
> 	file:////usr/local/src/bugs/552018/catalog2.xml
> Parse catalog: file:////usr/local/src/bugs/552018/catalog2.xml
> Loading catalog: file:////usr/local/src/bugs/552018/catalog2.xml
> Default BASE: file:////usr/local/src/bugs/552018/catalog2.xml
> delegateURI: http://invalid.invalid
> 	catalog3.xml
> DELEGATE_URI: http://invalid.invalid
> 	file:////usr/local/src/bugs/552018/catalog3.xml
> delegateSystem: http://invalid.invalid
> 	catalog3.xml
> DELEGATE_SYSTEM: http://invalid.invalid
> 	file:////usr/local/src/bugs/552018/catalog3.xml
> resolveSystem(http://invalid.invalid)
> Result: null

It chooses catalog2.xml. But there it fails, because delegateURI is
listed before delegateSystem.

You see the problem? Ask for a system ID and it will fail if a
delegateURI entry with the same URI is parsed before the relevant
delegateSystem entry and ditto for URI and delegateSystem before
delegateURI.

Regards, Daniel

--=-OVv1YbIc2eNwTB1qiTOv
Content-Type: application/x-compressed-tar; name="testcase.tar.gz"
Content-Disposition: attachment; filename="testcase.tar.gz"
Content-Transfer-Encoding: base64

H4sIAHg7WksAA+1Y227jNhD1a/0VrPYhQGFLlq+IGyfYJikQYLcbJNlti6IPtDW2CVCkQFJ2XOzH
d0YXR0Y2u0Vgpy2ieYhkkjOc2zmk4geNg0sHZTQY0DMcDTrVZymNMOx1h/3eoNft4fhwNBo02ODw
rjUaqXXcMNaI5NfXfWv+fyp+MOOOS73o+ffxgUKkAg/7/SfrP+yNyvr3R+Gw0QnDbnfUYJ3DuLMr
r7z+J2dYdrYCY4VWk6PQ7xydnTZPvr/4cH73+/UlK7qDXX/86d3VOfPaQfDh7e3VbRBc3F2wS+WE
27AbsFqmDi2w396/Y+eFzie0FgSXv3hNhuItnUvGQbBer33NrbBtnYDytVkEMx3HwjkAG0BmMTAg
gVsIyELhgh+5yDttNk9Kl9BxZSdeatQ4szdWPAY7drNxbmScLaC/40IF1b87MbA2wsHHmytWSmrE
LXaBu3VGqMWk9FSoFZci8ounxwrVawNzcT/x/MALKhZvN9ZBzGz2uIqeb/GkDPm0efD6b/Ef/ov4
H4S7/I/4D/s1/l9CXh/+IzS94M+Da2Fn4hUvXQJNTgKl2efwypNmD88EW/x3/yP4D7s5/ns1/l9C
Xi/+9wHU3mP874NWei+J/6Ja77niCzB+YrAsxgmwe9vjG/jv97vd7f1/GOJ42BsNOzX+X0Le7ElY
8w3b7SSGnbQSEVjGFRPKgZnzGTCnmVvCllce2s1HC9fbX7hAMeQFYHOjY+bWmiUS9e04H8jxVVFn
2qCBbI6zJ3uazYUEn90tBe4gubUVL1HdGa5swg0SyK7LU+2WLbYWbvmFnRO8vYMxEFES9CoPnSY3
2XYMUZ5SfM095foh1exntG/HOHCHObUQi5mWWrWRjAQyKnokhXVMz7f5JoeyVF/e8ziRMC5n7MQP
7ov3HwO7xCQEkZ65TYKsXIw3m9vF1a+GfQZ2A5I7sYIywiy4qzmbc2mhhd9LxXQZD7I4ls4Ai3kE
jE+zgwjyShmwCcxc0XJoZ4pHCmlQQqgJ/1GbWHAO2ZtpJTdUYJ4kkpag1R0n9NRxoTDlecM+9Lh9
aAehCk++vnO1PGXE7a21CftjA/az0n82m49mJzi1z3p8AjPVlk7TvA4Ku+svMLpVTWAOJXR+LaTE
aEUGn7k2cV4sriIWwTRdLDCRaAePaYtxWz9r26VYLBEzZE+l8RRMbjvWVNVyZTUlq9InSkXH94+P
MRPbwcnx8T4TcJ2Bm6L/dSlmS4ZcgbeLuUCPRQX6LeYl6VSKmYdExLycJLyzqtuIFL+8y+R65H+u
9TlXwDjymUn+e5+B4E3EiVnZKBTQ7VKnMkK6tFgW+YCpKb5qZZ1JZ0QhWEfGqa7c0MIWBWgLVbQS
iTk6TIxZ1TfAS13gmDZSBrOTD7vj0E5b707tu6ffSqnX7fwOikUpt2knIu9x6j6rU4PUjwyYxlls
WhG8LfMe6XmEbzyZKDlEEKJIHV6HbavMFNrcUGJSC9FOFviTzuxk5Oll+85OaTnDdJvu1HlWNjo9
MhQAhZnRm1YrUAIU5qkkADoAzcLnCdYc6GzwDX0bIDh9p7W0/g8E7gqrZnFZMk6ESnwt5htiWYVT
eAArbKPipCZXaBGmMOsr8iFVERi5IUsltL5wtlVimTzl3k3xcvh/udVSSy211FJLLbXUUksttdRS
y4vL3+2OSoYAKAAA


--=-OVv1YbIc2eNwTB1qiTOv--