Re: Discrepancy recognizing entity in attribute

There are various configuration options that can be set on the XML parsers,
with the best-known ones covered here.

https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#java

I find the API insanely fiddly; you need to know these arcane URIs and
pass them to setFeature or setProperty at the opportune moment while
facing east and counting backward from 73. There may be corresponding
system properties that can be set at Java startup, if the code that's
instantiating and configuring the parser doesn't expose it at the opportune
moment.

In my experience, there are some corresponding-but-not-identical behaviors
between SAX or DOM parsers on one hand and StAX parsers on the other. If I
remember right, if you set a SAX or DOM parser's
http://apache.org/xml/features/disallow-doctype-decl feature, that parser
will outright reject any document that has a DTD. In contrast, if you
instantiate a StAX parser and set its analogous XMLInputFactory.SUPPORT_DTD
property to false, it will accept documents with DTDs, but it won't learn
anything from the DTDs, with unresolved entities one possible result.

Regards,
-Chap

On 11/06/20 07:22, Michael Kay wrote:
> I'm afraid I'm as baffled by this as you are. I think it would be a good idea to do some experiments invoking the XML parser directly, taking Saxon and Oxygen out of the picture, to reduce the number of variables.
> 
> Michael Kay
> Saxonica
> 
>> On 6 Nov 2020, at 09:51, Joel Kalvesmaki <[email protected]> wrote:
>>
>> Hello everyone,
>>
>> Some further testing:
>>
>> On the same file I used the output of unparsed-text(X) on parse-xml(). The error was reported as follows:
>> First argument to parse-xml() is not a well-formed and namespace-well-formed XML document. XML parser reported: org.xml.sax.SAXParseException; systemId: file:/[XSL path].xsl; lineNumber: 5; columnNumber: 25; The entity "num" was referenced, but not declared.
>>
>> A similar error is thrown when the document in question is the value of -s(ource):
>> SXXP0003: Error reported by XML parser: The entity "num" was referenced, but not declared.
>> org.xml.sax.SAXParseException; systemId: file:/u:/fr/fm/temp/testxml11.xml; lineNumber: 5; columnNumber: 25; The entity "num" was referenced, but not declared.
>>
>> The error was not thrown if I removed the entity from the attribute value, or if I switched to XML 1.0 (or both). That's unexpected right? Or does XML 1.1, unlike 1.0, disallow entities in attribute values?
>>
>> I was able to replicate these errors in Oxygen by setting up a custom engine to Saxon. So I think there Oxygen has been integrated with Saxon in a way that obviates this error. Do they have their own XML parser they use as an intermediary?
>>
>> jk
>>
>>
>> On Thu, Nov 5, 2020 at 6:25 AM Joel Kalvesmaki <[email protected] <mailto:[email protected]>> wrote:
>> The document-available() tests were performed in conjunction with doc(), but I reported only on the former, after isolating the latter, which threw fatal error FODC0002: Document has been marked not available: file: X. 
>>
>> Again, though, with either of the two modifications mentioned below, things went fine.
>>
>> jk
>> One difficulty here is that document-available() returns only true or false, with no explanation. What happens when you call document() instead? Does it give any helpful diagnostics as to why the XML parsing failed?
>>
>> Clearly there's some difference between the cases regarding what XML parser is being used and/or how it is configured.
>>
>> Michael Kay
>> Saxonica
>>
>> On Thu, Nov 5, 2020 at 2:57 AM Joel Kalvesmaki <[email protected] <mailto:[email protected]>> wrote:
>> Greetings,
>>
>> I have the following document at URI X:
>>
>> <?xml version="1.1" encoding="UTF-8"?>
>> <!DOCTYPE a [<!ENTITY num "&#x23;">]>
>> <a>
>>    <works>&num;</works>
>>    <works-not val="&num;"/>
>> </a>
>>
>> When I run Saxon from the command line (with -xmlversion:1.1) on an XSLT 3.0 stylesheet that outputs merely the result of document-available('X') I get the value false. But the same stylesheet returns the value true if I run it through Saxon in Oxygen. Or it works on the command line, provided I do one of the following two alterations:
>> comment out the element <works-not> (so the entity works in the element but not the attribute value)
>> change version in the XML declaration to 1.0 (both entities are recognized)
>> I've tested the above on multiple versions of Saxon: 9.8, 9.9, 10.3, HE and EE. Unfortunately I'm at about the limits of my diagnostic powers. Any ideas out there?
>>
>> Best wishes,
>>
>> jk
>> -- 
>> Joel Kalvesmaki
>> kalvesmaki.com <http://kalvesmaki.com/>
>>
>> -- 
>> Joel Kalvesmaki
>> kalvesmaki.com <http://kalvesmaki.com/>
>>
>> -- 
>> Joel Kalvesmaki
>> kalvesmaki.com <http://kalvesmaki.com/>_______________________________________________
>> saxon-help mailing list archived at http://saxon.markmail.org/ <http://saxon.markmail.org/>
>> [email protected] <mailto:[email protected]>
>> https://lists.sourceforge.net/lists/listinfo/saxon-help <https://lists.sourceforge.net/lists/listinfo/saxon-help>
> 
> 
> 
> 
> 
> _______________________________________________
> saxon-help mailing list archived at http://saxon.markmail.org/
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/saxon-help 
>