[JIRA] Updated: (MDA-47) Disassembler stage may result in schema-invalid metadata

[Chad La Joie (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/MDA-47?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Chad La Joie updated MDA-47:
----------------------------

    Fix Version/s:     (was: 0.7)

> Disassembler stage may result in schema-invalid metadata
> --------------------------------------------------------
>
>                 Key: MDA-47
>                 URL: https://issues.shibboleth.net/jira/browse/MDA-47
>             Project: Metadata Aggregator
>          Issue Type: Bug
>          Components: SAML Metadata
>    Affects Versions: 0.6
>            Reporter: Ian Young
>            Assignee: Chad La Joie
>            Priority: Minor
>         Attachments: input.xml
>
>
> It looks like when the disassembler stage creates a new DomElementItem, the namespace context constructed for the new item contains only those namespace prefix definitions that are visibly used in elements and attributes in the subtree.  This seems to optimise out the case of a namespace prefix definition which is only used in an attribute of QName type: this is only visible as a use of the prefix if you know the schema that defines the attribute, which the disassembler does not.
> The result is that the resulting DomElementItem can fail schema checks even when the original document would pass.
> The case I came across was of an xsi:type="xs:string" in an EntityAttributes element, courtesy of Steven Carmody.  With xmlns:xs defined on the aggregate, everything validates at the aggregate level.  The individual EntityDescriptor is faulted, however:
> checkSchemas: UndeclaredPrefix: Cannot resolve 'xs:string' as a QName: the prefix 'xs' is not declared.
> One workaround appears to be to write documents such that the problematic prefix is defined within each EntityDescriptor, but obviously any kind of namespace normalisation occurring before the disassembly stage would negate that.
> Fixing this by carrying across *all* namespace prefix declarations in scope for the EntityDescriptor (but not appearing on the newly created one) might work, but might result in genuinely unused declarations cluttering things up and needing to be cleaned up later.  But, we already knew we needed more sophisticated namespace normalisation.
> I will try and come up with a small example document.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira