MVPXML Work Item Rss Feed

Created Issue: XPathDocumentWriter static constructor doesn't properly revert CAS assertion [25131]

element533 — Wed, 28 Oct 2009 21:09:21 GMT

Not sure if this has already been noted or is fixed yet, but I was just digging around in reflector and found a CAS flaw:

static XPathDocumentWriter()
{
ReflectionPermission perm = new ReflectionPermission(PermissionState.Unrestricted);
perm.Flags = ReflectionPermissionFlag.MemberAccess;
try
{
perm.Assert();
Type t = typeof(XPathDocument);
defaultConstructor = t.GetConstructor(BindingFlags.NonPublic | BindingFlags.Instance, null, Type.EmptyTypes, new ParameterModifier[0]);
loadWriterMethod = t.GetMethod("LoadFromWriter", BindingFlags.NonPublic | BindingFlags.Instance);
}
finally
{
CodeAccessPermission.RevertAssert();
}
}

CAS reversions should be done in catch-all handlers to prevent upstream exception filters from having the chance to run under elevated CAS permissions. The above code should be rewritten as:

static XPathDocumentWriter()
{
ReflectionPermission perm = new ReflectionPermission(PermissionState.Unrestricted);
perm.Flags = ReflectionPermissionFlag.MemberAccess;
try
{
perm.Assert();
Type t = typeof(XPathDocument);
defaultConstructor = t.GetConstructor(BindingFlags.NonPublic | BindingFlags.Instance, null, Type.EmptyTypes, new ParameterModifier[0]);
loadWriterMethod = t.GetMethod("LoadFromWriter", BindingFlags.NonPublic | BindingFlags.Instance);
CodeAccessPermission.RevertAssert();
}
catch
{
CodeAccessPermission.RevertAssert();
throw;
}
}

It's possible that other areas in the library need to be similarly updated. If you need more information, there is a reasonable body of knowledge on the Internet regarding this aspect of CAS.

BTW, Mvp.Xml is a really cool library, and I love using it!

Created Issue: GetCompiledExpression is not thread-safe

dkoning — Mon, 27 Apr 2009 14:57:49 GMT

We were using a previous version of mvp and got the error:
[IndexOutOfRangeException: Index was outside the bounds of the array.]
System.Collections.Generic.Dictionary`2.Insert(TKey key, TValue value, Boolean add) +7460198
System.Collections.Generic.Dictionary`2.set_Item(TKey key, TValue value) +11
Mvp.Xml.Common.XPath.XPathCache.GetCompiledExpression(String expression, XPathNavigator source) +68
Mvp.Xml.Common.XPath.XPathCache.SelectNodes(String expression, XmlNode source) +25

I saw this has been changed already: now a Hashtable is being used as cache. But still, this is not completely fixed, because the Hashtable is also not thread-safe, so you should use locking. Otherwise it might throw errors if you are adding more than one element at the same time to the cache.

My suggestion for the code would be:

private static readonly Dictionary<string, XPathExpression> Cache = new Dictionary<string, XPathExpression>();

/// <summary>
/// Retrieves a cached compiled expression, or a newly compiled one.
/// </summary>
private static XPathExpression GetCompiledExpression(string expression, XPathNavigator source)
{
if (!Cache.ContainsKey(expression))
{
XPathExpression expr = source.Compile(expression);
lock (Cache)
if (!Cache.ContainsKey(expression)) // it might have been added in the meanwhile
Cache.Add(expression, expr);
}
return Cache[expression].Clone();
}

Created Issue: XIncludingReader.WhitespaceHandling doesn't seem to do anything

frinetik — Tue, 04 Nov 2008 21:09:19 GMT

Maybe it's just me, but it doesn't appear that XIncludingReader.WhitespaceHandling actually does anything. No matter what I set it to, I always end up with whitespace nodes.

I implemented a workaround in the code that may be useful. In XIncludingReader.cs, Read(), before the switch (_reader.NodeType) I added:

if (_reader.NodeType == XmlNodeType.Whitespace && _whiteSpaceHandling != WhitespaceHandling.All)
_reader.Read();

This makes everything work as I'd expect for WhitespaceHandling.None and WhitespaceHandling.All (admittedly, WhitespaceHandling.Significant isn't handled properly by this).

Is there somewhere else that XIncludingReader.WhitespaceHandling is supposed to work?

Commented Issue: MvpXslTransform.Load doesn't close xml reader

earthware — Thu, 23 Oct 2008 20:19:43 GMT

Method MvpXslTransform.Load(string stylesheetUri, XsltSettings settings, XmlResolver stylesheetResolver) opens XmlReader for given stylesheetUri and doesn't close it after use. So stylesheet file got locked. I think it's necessary to add using statement. Like this:

public void Load(string stylesheetUri, XsltSettings settings, XmlResolver stylesheetResolver)
{
using( XmlReader reader = XmlReader.Create(stylesheetUri)
this.LoadStylesheetFromReader(reader, settings, stylesheetResolver);
}
Comments: ** Comment from web user: earthware **

yup I find this a real pain when doing any xlslt transform during development as it keeps the file locked until iis is restarted

Commented Issue: xinclude / encoding problem

psohm — Thu, 04 Sep 2008 15:31:16 GMT

hello
i've a problem with encoding and i can't resolve it.
I have a project which use the .net 2 xml api and everything work fine.
but if i have a file which contains strange characters (i don't put an example, otherwise codeplex refuse my post), xinclude don't word (but .net work)

the error message is :
..., valeur hexadécimale 0x0B, est un caractère non valide. Ligne 3, position 31."

i have made an example project which reproduce the bug
do you know how to solve that problem ?
although i admit i'm a bit lost, i think it's a encoding problem

thanks
Comments: ** Comment from web user: psohm **

the xml example file is :

<?xml version="1.0" encoding="utf-8"?>
<Magasin xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<Client Nom="KKK QK Q QKQKK Q QK" />
</Magasin>

Created Issue: xinclude / encoding problem

psohm — Thu, 04 Sep 2008 15:28:47 GMT

Commented Issue: Cannot get XpathCache to replace variables.

dcazzulino — Tue, 08 Jul 2008 05:18:35 GMT

I cannot get XpathCache to replace dynamic xpath variables in my xpath expression. I know the expression evaluates if I hardcode some test values.

This works:
string MenuDepthXpathStr = "/descendant-or-self::ul[count(ancestor-or-self::ul) >= $depth]";
string Depth = "1";

XPathNodeIterator TempList = XPathCache.Select(MenuDepthXpathStr, MenuDocXml, new XmlNamespaceManager(MenuDocXml.NameTable), new XPathVariable("depth", Depth));

However this doesnt:
string MenuDepthXpathStr = "/descendant-or-self::ul[count(ancestor-or-self::ul) >= $depth $highlighted]";
string Depth = "1";
string Highlighted = (SomeBoolVal? "and contains(@class, 'expanded')" : "");

XPathNodeIterator TempList = XPathCache.Select(MenuDepthXpathStr, MenuDocXml, new XmlNamespaceManager(MenuDocXml.NameTable), new XPathVariable("depth", Depth), new XPathVariable("highlighted", Highlighted));

It seems as though my variable cannot contain xpath it can only be values. Why is this? Is there any way to dynamically generate the xpath itself and not just insert values?
Comments: ** Comment from web user: dcazzulino **

That's just now how xslt variables work. We're just making it easier to use a feature that's provided by the System.Xml.Xsl namespace. We can't make changes, and I don't anticipate MS doing them either.

Again, if you're invoking Sprocs, you cannot do that. I'm afraid this is internally (.NET) the same.

Closed Issue: Cannot get XpathCache to replace variables.

dcazzulino — Tue, 08 Jul 2008 05:15:26 GMT

Closed Issue: XPathDocumentWriter::WriteRaw escapes XML when it shouldn't

dcazzulino — Sun, 06 Jul 2008 16:00:39 GMT

The WriteRaw method of the XPathDocumentWriter escapes the XML brackets < and > to < and > It seems that it behaves exactly as WriteString does.

Steps to reproduce:

XPathDocumentWriter xw = new XPathDocumentWriter();
xw.WriteStartElement("root");
xw.WriteRaw("<item>test</item>");
xw.WriteEndElement();
xw.Flush();
XPathNavigator xn = xw.Close();
Trace.WriteLine(xn.OuterXml);

The output is:

<root><item>test<item></root>

Whereas it should be:

<root><item>test</item></root>
Comments: Look in Reflector at the MS.Internal.Xml.Cache.XPathDocumentBuilder.WriteRaw implementation:

public override void WriteRaw(string data)
{
this.WriteString(data, TextBlockType.Text);
}

That's the wrapped class we're calling, it's provided by .NET and we can't change its behavior. So I guess you cannot use WriteRaw.

An alternative would be to parse the string with an XmlReader and use WriteNode instead.

CREATED ISSUE: XPathDocumentWriter::WriteRaw escapes XML when it shouldn't

roy_cornelissen — Mon, 10 Mar 2008 13:42:25 GMT

CREATED ISSUE: XpathCache Select that returns XpathNavigator

aromero78 — Thu, 21 Feb 2008 14:46:49 GMT

Would it be possible to get a XPathCache.SelectSingleNode function that returns a XPathNavigator?

COMMENTED ISSUE: Cannot get XpathCache to replace variables.

aromero78 — Thu, 21 Feb 2008 14:43:43 GMT

If at all possible I'd rather not be protected from myself. Would it be possible to break out this functionality into two separate functions? An XPathCache.Select method that allows for any string to be added and a new function that would check a give string for xpath injection? That way in situations where I control all of the variables and know that xpath injection is not possible I could use the XPathCache class to build any Xpath statement I wanted and could still check for injection if need be.

COMMENTED ISSUE: Cannot get XpathCache to replace variables.

dcazzulino — Thu, 31 Jan 2008 04:27:14 GMT

think of the xpathcache and pre-compiled xpath expressions as stored procedures.
The values you're replacing are not "string.format" kind of replacement. They are rather like sproc's parameters.

What you're trying to do is the equivalent of SQL injection but with xpath. it's called xpath injection and is something that doesn't work by design.

CREATED ISSUE: Cannot get XpathCache to replace variables.

aromero78 — Mon, 28 Jan 2008 22:58:55 GMT

CREATED ISSUE: MvpXslTransform.Load does not use XmlResolver during XmlReader.Create

FilipeToscano — Wed, 23 Jan 2008 16:21:25 GMT

File: Library\Main\Source\Exslt\XslMvpXslTransform.cs
Line: 179

[code]
public void Load(string stylesheetUri, XsltSettings settings, XmlResolver stylesheetResolver)
{
LoadStylesheetFromReader(XmlReader.Create(stylesheetUri), settings, stylesheetResolver);
}
[/code]

Should be:

[code]
public void Load(string stylesheetUri, XsltSettings settings, XmlResolver stylesheetResolver)
{
XmlReaderSettings readerSettings = new XmlReaderSettings();
readerSettings.XmlResolver = stylesheetResolver;

using ( XmlReader reader = XmlReader.Create( stylesheetUri, readerSettings ) )
{
LoadStylesheetFromReader( reader, settings, stylesheetResolver );
}
}

[/code]

CREATED ISSUE: MvpXslTransform.Load doesn't close xml reader

AndrewMayorov — Wed, 12 Dec 2007 17:59:01 GMT

CREATED ISSUE: SupportCharacterMaps Bug?

terryaney — Thu, 06 Dec 2007 09:01:23 GMT

Trying to perform a transform by passing a string Uri to a MvpTransform. Basically I have the following lines of code in c# 3.5 compiled against Mvp 2.3

xslt = new MVP.MvpXslTransform( false ); // Debugger.IsAttached
legacySettings = XsltSettings.TrustedXslt;

XmlReaderSettings dtd = new XmlReaderSettings();
dtd.ProhibitDtd = false;
xtr = XmlReader.Create( stylesheetUri, dtd );

// Note this next call is coming from a wrapper, and settings and resovler are both null, so the 'defaults' are used
xslt.Load( xtr, ( settings == null ? legacySettings : settings ), ( resolver == null ? new XmlUrlResolver() : resolver ) );

Problem is, this load line throws an exception saying DTD is Prohibited in the following function because supportCharacterMaps is defaulted to true.

protected void LoadStylesheetFromReader(XmlReader reader, XsltSettings settings, XmlResolver resolver)
{
if (supportCharacterMaps)
{
CharacterMappingXmlReader cmr = new CharacterMappingXmlReader(reader);
// This compiledTransform.Load() throws DTD prohibited error b/c I have an xsl:include.
this.compiledTransform.Load(cmr, settings, resolver);
this.characterMap = cmr.CompileCharacterMapping();
}
else
{
// If I set SupportCharacterMaps = false, this line successfully loads the transform.
// Is there a problem with the CharacterMappingXmlReader ctor? I tried to trace the code
// and it looked ‘right’, but I just wanted to run it by you.
this.compiledTransform.Load(reader, settings, resolver);
}
}

Thanks in advance. Hoping to turn the character maps back on.

CREATED ISSUE: accept attribute not supported when passing XmlResolver

mikeamundsen — Sat, 24 Nov 2007 22:25:09 GMT

i need to pass an XmlResolver class in order to pass Credentials. however, i've discovered that, when passing an XmlResolver to XIncludingReader, the "accept" and "accept-language" attributes are not honored.

i've checked out the source code and i think the issue is in the ProcessInterDocXMLInclusion class since it just calls GetEntity on the passed in resolver.

not sure what a clean solution would be here. somehow we need to get the "accept" attribute passed to the XmlResolver so that GetEntity can use it. I can craft a custom XmlResolver that has two new properties. even build a GetEntiry that will honor them and return a stream. but i'm not sure how to get the attributes from the <x:include .... accept="text/xml" /> element passed to the custom resolver.

any ideas?

Mike Amundsen

COMMENTED ISSUE: XIncludingReader doesn't work with Saxon.NET

olegt — Tue, 30 Oct 2007 00:46:16 GMT

Latest Saxon supports XInclude, but only in Java version. I tried Saxon.NET with XIncludingReader and figured out it doesn't work.
Saxon.NET is using GetAttribute(int), which is poorly implemented in XIncludingReader. The problem is that AttributeCount returns number of attributes + virtual xml:base and xml:lang, while GetAttribute(int) doesn't support virtual ones. This is easy to fix.
Comments: ** Comment from web user: olegt **

** Closed by olegt 6/12/2007 12:26 AM

COMMENTED ISSUE: XIncludingReader doesn't work with Saxon.NET

olegt — Thu, 18 Oct 2007 21:29:55 GMT

** Closed by olegt 6/12/2007 12:26 AM