[XML-DEV Mailing List Archive Home] [By Thread] [By Date] [Recent Entries] [Reply To This Message]

RE: RE: Compelling use case for XML Catalogs?

• From: Liam R E Quin <liam@w3.org>
• To: "Costello, Roger L." <costello@mitre.org>
• Date: Mon, 13 Jun 2011 12:19:02 -0400

On Mon, 2011-06-13 at 11:24 -0400, Costello, Roger L. wrote:
[...]
> XML Catalog only works if: 
> 
>     - you have pre-knowledge of exactly what URLs will
>       be present in the XML (XSLT, XSD, RNG, SVG, etc.) 
>       documents that you receive/process

No. URIs that are not in the catalog file will continue to resolve as
before.

>      - the XML documents will always contain the correct 
>        URL; there will never be any accidental or malicious
>        alteration of URLs

No. This is orthogonal. If you care about the identity of resolved
resources, use digital signatures.  It would be reasonable to argue that
(1) XML catalog doesn't cater for checking signatures;
(2) XML canonicalisation and signatures is intended for entire XML
documents and instance subtrees, and not for document type declarations;
however, you could treat an external document type definition as a text
file.

Note that these issues apply to any HTTP cache mechanism, including
corporate filewalls.

Liam


-- 
Liam Quin - XML Activity Lead, W3C, http://www.w3.org/People/Quin/
Pictures from old books: http://fromoldbooks.org/

• References:
  • Compelling use case for XML Catalogs?
    • From: "Costello, Roger L." <costello@mitre.org>
  • RE: Compelling use case for XML Catalogs?
    • From: "Costello, Roger L." <costello@mitre.org>
  • Re: RE: Compelling use case for XML Catalogs?
    • From: John Cowan <cowan@mercury.ccil.org>
  • RE: RE: Compelling use case for XML Catalogs?
    • From: "Costello, Roger L." <costello@mitre.org>