Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Attribute "href" of links is incorrectly validated #52

Closed
pcarana opened this issue Sep 6, 2017 · 2 comments
Closed

Attribute "href" of links is incorrectly validated #52

pcarana opened this issue Sep 6, 2017 · 2 comments

Comments

@pcarana
Copy link
Contributor

pcarana commented Sep 6, 2017

According to RFC 7483 section 4.2:

The "href" JSON value MUST be specified. All other JSON values are OPTIONAL.

Currently the file WEB-INF/notices/help.xml can have a link like this:

<link href="">foo.bar</link>

This link is correct when validated against META-INF/xsd/help.xsd: this is the issue. The schema should validate that the attribute must also have a value.

The issue isn't only at the "help" validation, it's in these schemas:

  • help.xsd
  • notices.xsd
  • tos.xsd
@pcarana pcarana added this to the v1.1.3 milestone Sep 22, 2017
@pcarana pcarana added the Solved label Sep 22, 2017
@pcarana
Copy link
Contributor Author

pcarana commented Oct 2, 2017

The schemas were updated to validate that "href" value must have at least 1 character.

The issue was:

<xs:attribute type="xs:string" name="href" use="required" />

The fix is:

<xs:attribute name="href" use="required">
	<xs:simpleType>
		<xs:restriction base="xs:string">
			<xs:minLength value="1" />
			<xs:whiteSpace value="collapse" />
		</xs:restriction>
	</xs:simpleType>
</xs:attribute>

@TheRedTrainer
Copy link

Verified. If a href in help.xml is defined with a empty value (""), the validation from help.xsd doesn't allow to start rdap server.

All the validations listed above (help.xsd, tos.xsd, notices.xsd) were modified in order to validate that href is not empty.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants