modularize attribute bundles in an AttributeFilterPolicy?

[Cantor, Scott]

> I don't know if this is good idea, but it works in my tests on IDP v3.   Define a
> DOCTYPE at the top of the attribute-filter.xml and include the ENTITY which
> includes another file with the xml block  you want to duplicate.    Then further
> down reference that entity in XML.   It's the equivalent of copying and
> pasting the same block of XML everywhere you put the entity reference.

In a local file context, that's probably a convenient trick, but in a remote one, it's really bad. That said, I don't really think we have a non-local model for configuration resources that is secure anyway, and as long as the resources are all under local control, I would only caution that I think if we had a way to block this, we might do it at some point.

I think the reason we can't block it now is that Spring is still doing a lot of its own XML parsing using mechanisms we can't override. We would if we could, because they really don't know what they're doing in there.

-- Scott