Escaping `XmlNameProcessors` write a colon in XML names as-is, producing output that can not be read back

Abierto Apto para principiantes
  • ¿Algo no está bien?
#923 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
85/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
java
Área
backend

Línea de trabajo

Revisa Base64NameProcessor y ReplaceNameProcessor. Modifica los patrones de regex VALID_XML_NAME y los conjuntos de caracteres permitidos para excluir dos puntos, de modo que nombres como a:b se escapen o reemplacen. Actualiza el método encodeName() en consecuencia. Agrega pruebas de ida y vuelta para verificar que los nombres que contienen dos puntos se serialicen a XML válido y se deserialicen sin StreamReadException.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Describe the bug

Both escaping processors from XmlNameProcessors treat a colon as a valid XML name character, so a name that contains one is written out verbatim:

  • Base64NameProcessor.VALID_XML_NAME is [a-zA-Z_:]([a-zA-Z0-9_:.-])*, i.e. a name holding a colon counts as already valid and is not escaped
  • ReplaceNameProcessor keeps : in both of its allowed sets (^[^a-zA-Z_:], [^a-zA-Z0-9_:-])

Output is namespace-aware, though, so the colon comes back as a prefix that nothing declares and the document can no longer be read by this module:

<DTO><badMap><a:b>xyz</a:b></badMap></DTO>

tools.jackson.core.exc.StreamReadException:
Undeclared namespace prefix "a"
 at [row,col {unknown-source}]: [1,18]
 at [Source: (String)"<DTO><badMap><a:b>xyz</a:b></badMap></DTO>"; line: 1, column: 19]
Caused by: com.ctc.wstx.exc.WstxParsingException: Undeclared namespace prefix "a"

Keys like a:b:c or :leading are not even well-formed, so they fail in the Stax reader before namespace resolution.

The javadoc of both processors lists the colon as "only exposed if underlying parser is in non-namespace-aware mode", but encoding has no knowledge of which parser will read the result back, and newAlwaysOnBase64Processor() already handles the same keys cleanly. Round-tripping names that are not valid XML names is what these two processors exist for, so the colon looks like an oversight in the allowed sets rather than a deliberate exception.

Version information

3.3.0-SNAPSHOT (3.x). The allowed sets have looked this way since the mechanism was added (#531), so 3.0/3.1/3.2 and 2.x behave the same.

Reproduction
public static class DTO {
    public Map<String, String> badMap = new HashMap<>();
}

private XmlFactory xmlFactory(XmlNameProcessor nameProcessor) {
    return XmlFactory.builder().xmlNameProcessor(nameProcessor).build();
}

@Test
public void colonInNameRoundTrips() throws Exception {
    XmlMapper mapper = XmlMapper.builder(
            xmlFactory(XmlNameProcessors.newBase64Processor())).build();

    DTO dto = new DTO();
    dto.badMap.put("a:b", "xyz");

    String xml = mapper.writeValueAsString(dto);
    // writes <DTO><badMap><a:b>xyz</a:b></badMap></DTO>
    mapper.readValue(xml, DTO.class); // StreamReadException: Undeclared namespace prefix "a"
}

Same for newReplacementProcessor(), which writes <a:b> rather than replacing the colon. newAlwaysOnBase64Processor() is fine, since it escapes every name.

Expected behavior

A name containing a colon should be escaped (base64, still a lossless round trip) or replaced, like any other character that cannot appear in a written XML name, so that what these processors write can be read back.

Only encodeName() would need to change: decodeName() keys off the prefix for base64 and is a no-op for replacement, so names read from a non-namespace-aware parser are still passed through untouched.

Additional context

PR #921 has the fix plus round-trip tests. Targeted at 3.x since it changes what gets written for these names.

Lenguaje dominante
Java
Estrellas
636
Forks
250
Merge medio
7 h 10 min
PR fusionados (30 d)
8

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de FasterXML/jackson-dataformat-xml

Todos los issues de FasterXML/jackson-dataformat-xml

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.