xml-xmlbeans-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Eric Vasilik" <eric...@bea.com>
Subject RE: xmlbeans xml security
Date Sat, 03 Jul 2004 17:22:40 GMT
Below, I mean internal to mean both bundled and tightly integrated to
the particular architecture of XmlBeans.  It would be much more portable
to write c14n in XmlCursor or even a cursor like interface, just like
the saver defines a SaveCur.  In this way, I could expose the saver as
an independent feature of XmlBeans.  If I did, one could get the
functionality of the saver over store of XML other than XmlBeans.

- Eric

-----Original Message-----
From: David Waite [mailto:mass@akuma.org] 
Sent: Friday, July 02, 2004 10:29 PM
To: xmlbeans-dev@xml.apache.org
Subject: Re: xmlbeans xml security

On Jul 2, 2004, at 10:47 PM, Eric Vasilik wrote:

> I would recommend writing the c14n serialization using XmlCursor.  One
> can navigate to the XmlObject for an element and interrogate the
Schema
> type, looking for default attributes, for example, and including them 
> in
> the serialization.  This assumes that the instance is valid with 
> respect
> to the schema.  Does c14n require that the instance is schema valid?

Nope. I actually didn't realize they had the attribute DTD-type stuff 
in there at all until this thread started :)

> Also, it seems that the handling of namespaces is significantly
> different for c14n than the current saver handles them.

Could you elaborate?

> You will have total control over the serialization this way and, the
> c14n serialization can be written as a utility on XmlBeans as opposed 
> to
> being in XmlBeans.  The XmlCursor interface is meant to enable high
> performance access to the store.
>
> Also, there are two other alternatives to using XmlCursor.  In the v2
> codebase, there is a low-level cursor access to the store which you
> could use, but the c14n implementation would then become an internal
> feature of XmlBeans.   This approach would probably yield the highest
> performance c14n implementation.

By internal, do you mean a bundled feature? Or just coupled more 
tightly to a particular release of XMLBeans?

> The other approach would be to use the implementation of the live DOM 
> on
> the v2 store.  Is there an open source implementation of c14n which is
> implemented on top of a DOM?  Could we use it instead of doing it 
> again?

Yes, but the current implementation for using the DOM for C14N within 
XML Security would not be nearly as efficient as doing it ourselves. It 
also has a workaround for Xalan's lack of support for the namespace 
axis, where it copies all namespaces in scope onto every element - it 
modifies the original document in the process of creating the canonical 
form.

-David Waite


- ---------------------------------------------------------------------
To unsubscribe, e-mail:   xmlbeans-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xmlbeans-dev-help@xml.apache.org
Apache XMLBeans Project -- URL: http://xml.apache.org/xmlbeans/


- ---------------------------------------------------------------------
To unsubscribe, e-mail:   xmlbeans-dev-unsubscribe@xml.apache.org
For additional commands, e-mail: xmlbeans-dev-help@xml.apache.org
Apache XMLBeans Project -- URL: http://xml.apache.org/xmlbeans/


Mime
View raw message