277683 - e4x: processing instruction with target name XML should not be allowed

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Martin Honnen]

The XML 1.0 specification at
<http://www.w3.org/TR/2004/REC-xml-20040204/#sec-pi>
says about the target names of processing instructions:
  "The target names "XML", "xml", and so on are reserved for standardization in
this or future versions of this specification."
and the grammar explictly excludes
  PITarget	   ::=   	Name - (('X' | 'x') ('M' | 'm') ('L' | 'l'))
thus I think E4X in Spidermonkey in the test case
<http://home.arcor.de/martin.honnen/mozillaBugs/e4x/processingInstructionXML.js>
should throw an error when parsing the XML literal but it doesn't.
Rhino throws an error.

Comment 1

[Brendan Eich [:brendan]]

Attachment: proposed fix, includes a hunk from the patch for bug 277650

I hope CVS can avoid conflicts, whichever bug's patch is checked in or applied
before the other is checked in.

/be

Comment 2

[Mike Shaver (:shaver -- probably not reading bugmail closely)]

Comment on attachment 170862 [details] [diff] [review]
proposed fix, includes a hunk from the patch for bug 277650

r=shaver (some overlap with the xml:lang bug, I see)

Comment 3

[Brendan Eich [:brendan]]

Fixed.

/be

Comment 4

[Martin Honnen]

Verified fixed with Mozilla 1.8b (Mozilla/5.0 (Windows; U; Windows NT 5.1;
en-US; rv:1.8b) Gecko/20050122)

Comment 5

[Bob Clary [:bc] (inactive)]

Attachment: e4x/Regress/regress-277683.js

Martin, with your permission this will be included in the javascript test
library.

Comment 6

[Bob Clary [:bc] (inactive)]

e4x/Regress/regress-277683.js checked in.

Comment 7

[Axel Hecht]

This breaks

foo = new XML('<?xml version="1.0"?>\n<foo/>');

which blocks me from reading regular on-the-web XML content. Should that be a
different bug or should we reopen this one?

Comment 8

[Martin Honnen]

(In reply to comment #7)
> This breaks
> 
> foo = new XML('<?xml version="1.0"?>\n<foo/>');
> 
> which blocks me from reading regular on-the-web XML content. 

It is supposed to "break", the E4X specification says that
  new XML(string)
is evaluated as 
  ToXML(string)
where ToXML is supposed to wrap the string into
  <parent xmlns="currentDefaultNamespace"></parent>
and then parse that according to XML rules so with above argument the XML parser
sees the markup

<parent xmlns="currentDefaultNamespace">
<?xml version="1.0"?>
<foo/>
</parent>

and that causes a parse error as it is not well-formed.

So the E4X spec would need a change to allow passing in the complete markup of
an XML document including the XML declaration as a string, the current behavior
is according to the spec.

Comment 9

[Brendan Eich [:brendan]]

Perhaps the spec has a usability bug here, but this code-level bugzilla bug
should stay closed.  I'll raise the issue with ECMA TG1.

/be

Comment 10

[Axel Hecht]

I halfway-successfully worked around this now, which was still way easier than
to deal with the DOM ;-). All I need to do is to water-proof my regexp a bit more.
I'll paste it here once it's done.