Mailing-List: contact security-dev-help@xml.apache.org; run by ezmlm
Precedence: bulk
Reply-To: security-dev@xml.apache.org
Received-SPF: pass (herse.apache.org: domain of jsp@pkc.com designates
 216.75.143.162 as permitted sender)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: RE: What is XMLUtils::addReturnToElement for?
Date: Wed, 4 Apr 2007 14:40:48 -0400
Message-ID: <16E2027582CDB74180896CDB4B8CC1F905664DA8@PKCVT01.pkc.com>
In-Reply-To: 
 <OF8A20C490.2FE9EFE4-ON852572B3.005F3CF2-852572B3.005FEF02@us.ibm.com>
Thread-Topic: What is XMLUtils::addReturnToElement for?
Thread-Index: Acd23xj00ciG4KDoQxK7Dq0qF7iiPQAB+MCA
References: 
 <OF8A20C490.2FE9EFE4-ON852572B3.005F3CF2-852572B3.005FEF02@us.ibm.com>
From: "Jesse Pelton" <jsp@PKC.com>
To: <security-dev@xml.apache.org>

By my reading of the Apache License, Version 2.0 (which is the XML
Security license), you are under no obligation to distribute source
code.

Of course, if you plan to distribute the code for your project, that
pretty much has to include your modifications to XML Security code.  If
that's the situation, consider opening a bug report and attaching a
patch that implements the desired change.

I know nothing of the code in question, but it sounds to me like it
would be better to conditionally skip the call to addReturnToElement()
rather than changing its behavior.  With a name like that, I think it
would be astonishing if it didn't add a line break under any
circumstances.  Of course, you'd ideally have a clean, flexible, robust
mechanism for controlling where breaks are added.

-----Original Message-----
From: Michael McIntosh [mailto:mikemci@us.ibm.com]=20
Sent: Wednesday, April 04, 2007 1:28 PM
To: security-dev@xml.apache.org
Subject: What is XMLUtils::addReturnToElement for?

I know what XMLUtils::addReturnToElement does, by why do it?
I acknowledge that adding the occasional line to an XML document makes
it=20
more readable in certain circumstances, but I'd really like to be able
to=20
turn it off.
Actually I'd like to leave it alone, but a system I need to interoperate

with cannot accept Signatures with whitespaces in certain places.
No need to tell me its should be allowed - I know - but I cannot change=20
their code.
I have a fix - which is to change the source code for the funciton to
turn=20
it into a no-op when a system property is set, but I'd like to not need
to=20
redistribute my modified Apache source code.

Thanks,
Mike

Michael McIntosh
Java and Web Services Security Group
Security, Privacy, and Extensible Technologies Department
IBM Research