This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 4464 - [XSLT 2.0] Missing rules for misuse of the xmlns namespace
Summary: [XSLT 2.0] Missing rules for misuse of the xmlns namespace
Status: CLOSED FIXED
Alias: None
Product: XPath / XQuery / XSLT
Classification: Unclassified
Component: XSLT 2.0 (show other bugs)
Version: Recommendation
Hardware: PC Windows XP
: P2 normal
Target Milestone: ---
Assignee: Michael Kay
QA Contact: Mailing list for public feedback on specs from XSL and XML Query WGs
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-04-13 09:29 UTC by Michael Kay
Modified: 2008-03-20 10:55 UTC (History)
0 users

See Also:


Attachments

Description Michael Kay 2007-04-13 09:29:26 UTC
There seem to be some extra rules needed in XSLT to prevent abuse of the name "xmlns" and the associated URI "http://www.w3.org/2000/xmlns/".

See also bug #4463 which raises similar problems for XQuery. The problems for XSLT are less serious because XSLT inherits the rules that apply to namespace-well-formed XML documents, however there are still one or two omissions.

XML Namespaces 1.1 states: 

<quote>
The prefix xmlns is used only to declare namespace bindings and is by
definition bound to the namespace name http://www.w3.org/2000/xmlns/. It MUST
NOT be declared or undeclared. Other prefixes MUST NOT be bound to this
namespace name, and it MUST NOT be declared as the default namespace. Element
names MUST NOT have the prefix xmlns.
</quote>

1. We should probably make http://www.w3.org/2000/xmlns/ a reserved namespace in section 3.2. This would ban the use of this namespace (and the prefix xmlns) in the names of variables, functions, templates, etc. It's not obvious that the world falls apart if we don't ban it, but we either allow it or we disallow it, and disallowing it requires fewer test cases...

2. We should disallow use of the namespace http://www.w3.org/2000/xmlns/ in the name of an element constructed using xsl:element. We should also either disallow the use of the prefix xmlns, or say that if xmlns is used then a different prefix will be substituted. This should match what we do for attributes (see 4 below).

3. We should disallow use of the namespace http://www.w3.org/2000/xmlns/ in the name of an attribute constructed using xsl:attribute.

4. We currently say, in a non-normative example in 11.3, that it is not an error to write <xsl:attribute name="xmlns:xsl" namespace="file://some.namespace">, because namespace fixup will cause a prefix other than "xmlns" to be used. This relies on the statement "In the event of a conflict this prefix (or absence of a prefix) may subsequently be changed during the namespace fixup process" - that is, use of "xmlns" to refer to a namespace other than http://www.w3.org/2000/xmlns/ is treated as a conflict for namespace fixup to sort out. I don't see any strong reason to change this interpretation, though we could make it more explicit rather than relying so heavily on an example. If this is the rule for attributes, then we should probably use the same rule for elements (see 2 above).

5. In xsl:namespace, we currently ban the use of the prefix xmlns, but we should also ban the use of the URI http://www.w3.org/2000/xmlns/

6. Under namespace fixup, we state one of the constraints as "A namespace node must not have the name xmlns." We should add "... or the string value http://www.w3.org/2000/xmlns/". (We should also add this rule to XDM.)
Comment 1 Sharon Adler 2007-04-17 14:45:19 UTC
The WG met on 17 April 2007 at the F2F at Red Hat and reviewed and accepted M. Kay's proposal in principle.  M.Kay will write this up as a proposed erratum.  Once we have actual text the WG will vote to make this an erratum.
Comment 2 Michael Kay 2007-04-23 15:22:10 UTC
Proposed textual changes:

1. In 3.2 Reserved Namespaces, first bulleted list, add a new item: "The namespace "http://www.w3.org/2000/xmlns/" is reserved for use as described in [Namespaces in XML 1.0]. No element or attribute node can have a name in this namespace, and although the prefix "xmlns" is implicitly bound to this namespace, no namespace node will ever define this binding.

2a. In 11.1, xsl:element, add to the definition of ERR XTDE0835 so that it reads: "[ERR XTDE0835] It is a non-recoverable dynamic error if the effective value of the namespace attribute is not in the lexical space of the xs:anyURI data type or if it is the string 'http://www.w3.org/2000/xmlns/'."

2b. In 11.1, xsl:element, after the sentence "In the event of a conflict a prefix may subsequently be added, changed, or removed during the namespace fixup process (see 5.7.3 Namespace Fixup).", add "The term 'conflict' here means any violation of the constraints defined in [DataModel], for example the use of the same prefix to refer to two different namespaces in the element and in one of its attributes, the use of the prefix "xml" to refer to a namespace other than the XML namespace, or any use of the prefix "xmlns"."
3. In 11.3, xsl:attribute, add to the definition of ERR XTDE0865 so that it reads: "[ERR XTDE0865] It is a non-recoverable dynamic error if the effective value of the namespace attribute is not in the lexical space of the xs:anyURI data type or if it is the string 'http://www.w3.org/2000/xmlns/'.

4. In 11.3, xsl:attribute, after the sentence "In the event of a conflict this prefix (or absence of a prefix) may subsequently be changed during the namespace fixup process (see 5.7.3 Namespace Fixup).", add "The term 'conflict' here means any violation of the constraints defined in [DataModel], for example the use of the same prefix to refer to two different namespaces in different attributes of the same element, the use of the prefix "xml" to refer to a namespace other than the XML namespace, or any use of the prefix "xmlns"."

5. In 11.7 Creating Namespace Nodes, expand the definition of error XTDE0905 so that it reads: "[ERR XTDE0905] It is a non-recoverable dynamic error if the string value of the new namespace node is not valid in the lexical space of the data type xs:anyURI, or if it is the string 'http://www.w3.org/2000/xmlns/'".

6. In 5.7.3, first bulleted list, last item, add to the existing text so that it reads: A namespace node must not have the name xmlns or the string value 'http://www.w3.org/2000/xmlns/'
Comment 3 Michael Kay 2007-05-17 16:51:46 UTC
On 16 May 2007 the WG approved this wording.
Comment 4 Michael Kay 2007-05-18 09:38:31 UTC
Will be published as Erratum E6.