migrating xml schema definitions from v2 to v3 ?

[Cantor, Scott]

On 2/28/13 3:05 PM, "Tom Zeller" <tzeller at dragonacea.biz> wrote:

>Or just publish the xsd's to http://shibboleth.net/schemas, like others
>do.
>
>I think I would need Scott to say more about the runtime schema
>location customization he has mentioned.

It's basically that I want to make sure we don't have any reliance on
xsi:schemaLocation anywhere in the code and that it actually is ignored.
Injecting schemas like that via documents can introduce security bugs.
It's a non-feature that should have been flagged from the XML Schema spec
to begin with, and is strictly optional to honor as a processor (so
there's nothing illegal about ignoring it).

The other issue is preventing remote lookup of schemas. We should be able
to do that for our own code, but IIRC Spring was buggy and broke when we
attempted to do that universally. That probably is still true, in which
case we should be able to implement a whitelist of sorts to permit only
lookups we want to permit. And we should file the bug with Spring if we
haven't already.

-- Scott