Luke-Jr wrote:z-man wrote:Luke: Then we'd distribute two DTDs, one official and one that allows the stuff that works, but is experimental or transitional.
All the stuff *works*... ph just doesn't like it =p
A small misunderstanding. I'll rephrase slightly:
Then we'd distribute two DTDs, one official ( allowing the stuff ph likes ) and one inofficilal ( that allows the stuff that works, but is experimental or transitional or is disliked bt ph for some other reason ).
... and give up? I'd rather it fetch the files.
How would that have any chance of success? I don't understand. Please point out the flaw in the following logic ( add "probably" or "likely" before every sentence since the reasoning is only heuristic and not 100% conclusive )
1. DTDs describe what the source code is able to parse and are used for validation
2. We'll have DTDs in the distribution for all document types the version is able to parse
3. Assume we downloaded a map file that uses a DTD not available locally
4. because of 2, that means the map ( assuming the mapper did not use a more complex DTD than required ) can't be parsed by the running source
5. the map file won't work.
I'd consider trying to use a map file with an unsupported DTD an error just like a parsing error. You certainly would not suggest to continue on a syntax error.
Of course, 2. is an assumption. I think we definitely want to control the DTDs, because the DTDs are a part of AA. Who, if not the developers, knows how a DTD should look? An alternative to putting everything into the distribution would be to make all DTDs available for download on some place we control, and tell libxml to only fetch them from there.
At least, additional downloads by libxml should be a user controllable option. My vote would go to turn it off by default.
I would hope server admin checked the map to be sure it's ok first
Assume the map is OK, but it triggers another download within libxml ( It appears only DTDs are fetched ). At the time the admin checks that, it is OK too. Later however, it gets changed to something else that is either illegal or exploits a ( hypothetical ) security hole of libxml or AA. ( The map and its hash stay unchanged. ) If we generally allow automatic downloads by libxml, we're prone to this attack.
No, because we want to fetch the stuff anyway. We just want to cache it also.
You want that.
We haven't decided this yet.