This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 4463 - [XQuery] Missing rules for misuse of the xmlns namespace
Summary: [XQuery] Missing rules for misuse of the xmlns namespace
Status: RESOLVED FIXED
Alias: None
Product: XPath / XQuery / XSLT
Classification: Unclassified
Component: XQuery 1.0 (show other bugs)
Version: Recommendation
Hardware: PC Windows XP
: P2 normal
Target Milestone: ---
Assignee: Don Chamberlin
QA Contact: Mailing list for public feedback on specs from XSL and XML Query WGs
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-04-12 23:06 UTC by Michael Kay
Modified: 2008-04-29 18:51 UTC (History)
0 users

See Also:


Attachments

Description Michael Kay 2007-04-12 23:06:36 UTC
There seem to be some extra rules needed to prevent abuse of the name "xmlns" and the associated URI "http://www.w3.org/2000/xmlns/".

XML Namespaces 1.1 states: 

<quote>
The prefix xmlns is used only to declare namespace bindings and is by definition bound to the namespace name http://www.w3.org/2000/xmlns/. It MUST NOT be declared or undeclared. Other prefixes MUST NOT be bound to this namespace name, and it MUST NOT be declared as the default namespace. Element names MUST NOT have the prefix xmlns.
</quote>

There seems to be no corresponding rule in XQuery for namespace declarations in the prolog. For namespace declarations appearing in direct element constructors we have half of the rule, namely the ban on binding the prefix xmlns, but there is no ban on binding a prefix to the URI http://www.w3.org/2000/xmlns/

There is a rule against use of this namespace in a constructed attribute, but it is badly worded:

<quote>
The node-name property of the constructed attribute (an expanded QName) is checked as follows: If its URI part is http://www.w3.org/2000/xmlns/ (corresponding to namespace prefix xmlns) or if it is in no namespace and its local name is xmlns, a dynamic error [err:XQDY0044] is raised.
</quote>

This hints that the error only arises if (a) the prefix is xmlns, *and* (b) the URI is http://www.w3.org/2000/xmlns/, whereas it should arise if *either* of these conditions is true.

There is also no corresponding rule for computed element constructors. XML Namespaces 1.1 says "Element names MUST NOT have the prefix xmlns", and the earlier rule also implies that they must not have the URI http://www.w3.org/2000/xmlns/.

It might also be useful to state some of these rules as constraints in XDM.
Comment 1 Frans Englich 2007-04-13 10:02:45 UTC
Nice catches.

This area of problems was partly brought up on  
w3c-xml-query-wg@w3.org once, Computed attributes: 'xmlns' with non-empty namespace:

http://lists.w3.org/Archives/Member/w3c-xml-query-wg/2006Dec/0058.html

Looks like the prolog namespace declaration also needs to block out binding an arbitrary prefix to namespace http://www.w3.org/XML/1998/namespace.

I'll look into writing tests for this for the XQTS.
Comment 2 Don Chamberlin 2007-07-31 19:09:52 UTC
Michael,
On June 27, 2007, the Query working group agreed in principle with your suggested changes and asked me to prepare a draft of the revised text.
This draft is attached below (in six parts). Will you please let me know
whether you find the draft changes to be acceptable?
Thanks,
--Don Chamberlin (for the Query working group)

(a) In Section 3.7.3.1, Computed Element Constructors:
Add the following new paragraph, just following the reference to [err:XQDY0074]:
It is a dynamic error [err:XQDY0044] if the node-name of the constructed 
element node has the namespace URI http://www.w3.org/2000/xmlns/, 
or has the namespace prefix xmlns.

(b) In Section 3.7.3.2, Computed Attribute Constructors:
Old Text:
The node-name property of the constructed attribute (an expanded QName)
is checked as follows: If its URI part is http://www.w3.org/2000/xmlns/
(corresponding to namespace prefix xmlns) or if it is in no namespace and
its local name is xmlns, a dynamic error [err:XQDY0044] is raised.
Replacement Text:
It is a dynamic error [err:XQDY0044] if the node-name of the constructed 
attribute node has the namespace URI http://www.w3.org/2000/xmlns/, 
or has the namespace prefix xmlns, or has no namespace prefix and has the 
local name xmlns.

(c) In Section 4.12, Namespace Declaration:
At the end of the paragraph that begins with "The namespace prefix" and
ends with [err:XQST0033], add the following sentence:
The namespace URI specified in a namespace declaration must not be
http://www.w3.org/XML/1998/namespace or http://www.w3.org/2000/xmlns/ [err:XQST0070].

(d) In Section 4.12, Namespace Declaration:
In the paragraph that begins with "XQuery has several predeclared namespace
prefixes", change the parenthesized text as follows:
Old text:
(however, the prefix xml may not be redeclared, and no other prefix may
be bound to the namespace URI associated with the prefix xml [err:XQST0070]).
Replacement text:
(however, the binding of the prefix xml may not be overridden [err:XQST0070]).

(e) Change to text of error code XQDY0044:
Old text:
It is a dynamic error if the node-name property of the node constructed by
a computed attribute constructor is in the namespace http://www.w3.org/2000/xmlns/
(corresponding to the namespace prefix xmlns), or is in no namespace and has
local name xmlns.
Replacement text:
It is a dynamic error if the node-name of the node constructed by a
computed element or attribute constructor has the namespace URI 
http://www.w3.org/2000/xmlns/ or has the namespace prefix xmlns.
It is also a dynamic error if the node-name of the node constructed by a
computed attribute constructor has no namespace prefix and has the local name
xmlns.

(f) Change to text of error code XQST0070:
Old text:
A static error is raised if a namespace URI is bound to the predefined prefix
xmlns, or if a namespace URI other than http://www.w3.org/XML/1998/namespace
is bound to the prefix xml, or if the prefix xml is bound to a namespace URI
other than http://www.w3.org/XML/1998/namespace.
Replacement text:
It is a static error if the namespace prefix specified in a namespace
declaration is xml or xmlns, or if the namespace URI specified in a
namespace declaration is http://www.w3.org/XML/1998/namespace or
http://www.w3.org/2000/xmlns/.


Comment 3 Michael Kay 2007-08-01 20:33:26 UTC
I have a feeling this can be done a bit more declaratively, by defining constraints on the static context and the in-scope namespaces of a dynamically constructed element. This reduces the number of places we need to state the rules, and reduces the risk of missing one.

I've also changed the proposal so that using "xmlns" as a prefix in an element or attribute name is a conflict rather than an error, and results in a different prefix being substituted in the same way as for other prefix conflicts. This is (a) because that's what XSLT does, and (b) because I think you can read the current spec this way.

I've also changed it, to align with the rule in XML and avoid unnecessary changes to the current spec, so that it's not an error to create an explicit binding of the prefix xml to the XML namespace (it's just redundant).

Of course, the editor is welcome to add notes or cross-references to draw attention to these rules in other places where appropriate. The main such case is in attribute constructors, where users will try to create namespace declarations by pretending they are attributes.

(a) In 2.1.1 Static Context, Statically known namespaces, add the rule "The statically known namespaces will never contain two bindings for the same prefix. They will always include a binding of the prefix xml to the namespace http://www.w3.org/XML/1998/namespace, and will never bind any other prefix to that namespace. They will never include a binding for the prefix xmlns or for the namespace http://www.w3.org/2000/xmlns/, and any attempt to create such a binding is a static error [err:XQST0070].

(b) In 3.7.4, fourth bullet, after the first sentence, "For each namespace used in the name of the constructed element or in the names of its attributes, a namespace binding must exist." add "It is a dynamic error if this would require creation of a binding for the namespace http://www.w3.org/2000/xmlns/ [err:XQDY0074]." After "If this would result in a conflict, because it would require two different bindings of the same prefix" add ", or because it would require a binding of the prefix xmlns, or a binding of a prefix other than xml to the namespace http://www.w3.org/XML/1998/namespace, or a binding of a namespace other than http://www.w3.org/XML/1998/namespace to the prefix xml, " 

(c) 3.7.1.2 Namespace Declaration Attributes, bullet 3, says "It is a static error [err:XQST0070] if a namespace declaration attribute binds a namespace URI to the predefined prefix xmlns". We can now drop this, it is incomplete and is subsumed by (a) above.

(d) In Section 3.7.3.2, Computed Attribute Constructors:
Old Text:
The node-name property of the constructed attribute (an expanded QName)
is checked as follows: If its URI part is http://www.w3.org/2000/xmlns/
(corresponding to namespace prefix xmlns) or if it is in no namespace and
its local name is xmlns, a dynamic error [err:XQDY0044] is raised.
Replacement Text:
The node-name property of the constructed attribute (an expanded QName)
is checked as follows: If it is in no namespace and its local name is xmlns, a dynamic error [err:XQDY0044] is raised.
[: the other condition is now covered by (b) :]

(e) In Section 4.12, Namespace Declaration:
At the end of the paragraph that begins with "The namespace prefix" and
ends with [err:XQST0033], delete the phrase "must not be xml or xmlns [err:XQST0070], and" (it's now covered by (a) above).

(f) In Section 4.12, Namespace Declaration:
In the paragraph that begins with "XQuery has several predeclared namespace
prefixes", change the parenthesized text as follows:
Delete the parenthetical text:
"(however, the prefix xml may not be redeclared, and no other prefix may
be bound to the namespace URI associated with the prefix xml [err:XQST0070])".
(it's covered by (a) above)

(g) Change to text of error code XQDY0044:
Old text:
It is a dynamic error if the node-name property of the node constructed by
a computed attribute constructor is in the namespace
http://www.w3.org/2000/xmlns/
(corresponding to the namespace prefix xmlns), or is in no namespace and has
local name xmlns.
Replacement text:
It is a dynamic error if the node-name of the node constructed by a computed element or attribute constructor has the namespace URI 
http://www.w3.org/2000/xmlns/. It is also a dynamic error if the node-name of the attribute node constructed by a computed attribute constructor has no namespace prefix and has the local name
xmlns.

(f) Change to text of error code XQST0070:
Old text:
A static error is raised if a namespace URI is bound to the predefined prefix
xmlns, or if a namespace URI other than http://www.w3.org/XML/1998/namespace
is bound to the prefix xml, or if the prefix xml is bound to a namespace URI
other than http://www.w3.org/XML/1998/namespace.
Replacement text:
A static error is raised if a namespace URI is bound to the predefined prefix
xmlns, or if a prefix is bound to the namespace URI http://www.w3.org/2000/xmlns/,
or if a namespace URI other than http://www.w3.org/XML/1998/namespace
is bound to the prefix xml, or if the prefix xml is bound to a namespace URI
other than http://www.w3.org/XML/1998/namespace.
Comment 4 Don Chamberlin 2008-04-29 18:51:56 UTC
On 29 April 2008, the working group resolved this bug report by approving the following erratum text:

(1) Section 4.12 (Namespace Declaration)
Replace paragraph 5 as follows:
The namespace prefix specified in a namespace declaration must not be xml 
or xmlns [err:XQST0070]. The namespace URI specified in a namespace 
declaration must not be http://www.w3.org/XML/1998/namespace or 
http://www.w3.org/2000/xmlns/ [err:XQST00070]. The namespace prefix 
specified in a namespace declaration must not be the same as any namespace 
prefix bound in the same module by a module import, schema import, module 
declaration, or another namespace declaration [err:XQST0033].

(2) Section 3.7.1.2 (Namespace Declaration Attributes)
Replace the third bullet as follows:
It is a static error [err:XQST0070] if a namespace declaration attribute 
attempts to do any of the following:
(a) Bind the prefix xml to some namespace URI other than 
http://www.w3.org/XML/1998/namespace
(b) Bind a prefix other than xml to the namespace URI 
http://www.w3.org/XML/1998/namespace
(c) Bind the prefix xmlns to any namespace URI
(d) Bind any prefix to the namespace URI 
http://www.w3.org/2000/xmlns/

(3) Redefine error XQST0070 as follows:
A static error is raised if one of the predefined prefixes xml or xmlns 
appears in a namespace declaration, or if any of the following conditions 
can be statically detected in any expression or declaration:
(a) The prefix xml is bound to some namespace URI other than 
http://www.w3.org/XML/1998/namespace
(b) A prefix other than xml is bound to the namespace URI 
http://www.w3.org/XML/1998/namespace
(c) The prefix xmlns is bound to any namespace URI
(d) A prefix other than xmlns is bound to the namespace URI 
http://www.w3.org/2000/xmlns/

(4) Section 3.7.3.2 (Computed Attribute Constructors)
Replace the paragraph following the first numbered list as follows:
A dynamic error [XQDY0044] is raised if the node-name of the constructed 
attribute node has any of the following properties:
(a) Its namespace prefix is xmlns
(b) It has no namespace prefix and its local name is xmlns
(c) Its namespace URI is http://www.w3.org/2000/xmlns/
(d) Its namespace prefix is xml and its namespace URI is not 
http://www.w3.org/XML/1998/namespace
(e) Its namespace prefix is other than xml and its namespace URI is 
http://www.w3.org/XML/1998/namespace

(5) Redefine error XQDY0044 as follows:
It is a dynamic error if the node-name of a node constructed by a computed 
attribute constructor has any of the following properties:
(a) Its namespace prefix is xmlns
(b) It has no namespace prefix and its local name is xmlns
(c) Its namespace URI is http://www.w3.org/2000/xmlns/
(d) Its namespace prefix is xml and its namespace URI is not 
http://www.w3.org/XML/1998/namespace
(e) Its namespace prefix is other than xml and its namespace URI is 
http://www.w3.org/XML/1998/namespace

(6) Section 3.7.3.1 (Computed Element Constructors)
Insert the following paragraph following the first numbered list:
A dynamic error [err:XQDY0096] is raised if the node-name of the 
constructed element node has any of the following properties:
(a) Its namespace prefix is xmlns
(b) Its namespace URI is http://www.w3.org/2000/xmlns/
(c) Its namespace prefix is xml and its namespace URI is not 
http://www.w3.org/XML/1998/namespace
(d) Its namespace prefix is other than xml and its namespace URI is 
http://www.w3.org/XML/1998/namespace

(7) Define a new error XQDY0096 as follows:
It is a dynamic error if the node-name of a node constructed by a computed 
element constructor has any of the following properties:
(a) Its namespace prefix is xmlns
(b) Its namespace URI is http://www.w3.org/2000/xmlns/
(c) Its namespace prefix is xml and its namespace URI is not 
http://www.w3.org/XML/1998/namespace
(d) Its namespace prefix is other than xml and its namespace URI is 
http://www.w3.org/XML/1998/namespace

Regards,
Don Chamberlin (for the Query Working Group)