zorba-coders team mailing list archive

[Federico Cavalieri <859968@xxxxxxxxxxxxxxxxxx>]

** Description changed:

  The following query creates an element node with a single children (not
  attribute). The attribute is then retrievable using child::node() but
  not attribute::*
+ 
+ import module namespace doc = "http://www.zorba-
+ xquery.com/modules/store/dynamic/documents";
+ 
+ declare function local:dump-types($nodes as node()*) as element()*
+ {
+ for $node in $nodes
+ return
+  if ($node instance of text()) then ()
+  else
+  (
+  element
+  {
+  if ($node instance of element()) then node-name($node)
+  else if ($node instance of attribute()) then concat("attr-",string(node-name($node)))
+  else if ($node instance of text()) then 'text'
+  else if ($node instance of document-node()) then 'document-node'
+  else if ($node instance of comment()) then 'comment'
+  else if ($node instance of processing-instruction()) then 'processing-instruction'
+  else 'unknown'
+  }
+  {
+   for $attr in $node/@*
+    return <attributes>{local:dump-types($attr)}</attributes>,
+   for $elem in $node/node()
+    return <children>{local:dump-types($elem)}</children>
+  }
+  )
+ };
+ 
+ put(attribute {"test"}{"test"},"http://www.zorba-xquery.com/b";);
+ count(doc:document("http://www.zorba-xquery.com/b";)/child::node()),
+ local:dump-types(doc:document("http://www.zorba-xquery.com/b";))
+ 
+ Returns:
+ 
+ <?xml version="1.0" encoding="UTF-8"?>
+ 1<document-node><children><attr-test/></children></document-node>
+ 
+ Segmentation faults then are easy:
  
  import module namespace doc = "http://www.zorba-
  xquery.com/modules/store/dynamic/documents";
  
  declare function local:dump-types($nodes as node()*) as element()*
  {
  for $node in $nodes
  return
  	if ($node instance of text()) then ()
  	else
  	(
  	element 
  	{
  	if ($node instance of element()) then node-name($node)
  	else if ($node instance of attribute()) then concat("attr-",string(node-name($node)))
  	else if ($node instance of text()) then 'text'
  	else if ($node instance of document-node()) then 'document-node'
  	else if ($node instance of comment()) then 'comment'
  	else if ($node instance of processing-instruction()) then 'processing-instruction'
  	else 'unknown'	 
  	}	
  	{
  		for $attr in $node/@*
  			return <attributes>{local:dump-types($attr)}</attributes>,
  		for $elem in $node/node()
  			return <children>{local:dump-types($elem)}</children>			
  	}
  	)
  };
  
  put(attribute {"test"}{"test"},"http://www.zorba-xquery.com/b";);
- count(doc:document("http://www.zorba-xquery.com/b";)/child::node()),
- local:dump-types(doc:document("http://www.zorba-xquery.com/b";))
- 
- Returns:
- 
- <?xml version="1.0" encoding="UTF-8"?>
- 1<document-node><children><attr-test/></children></document-node>
+ replace node doc:document("http://www.zorba-xquery.com/b";)/child::node() with attribute{"aaa"}{"xxx"};

** Changed in: zorba
   Importance: Low => Medium

** Summary changed:

- Using put on an attribute produces an invalid Xdm instance
+ Using put on an attribute produces an invalid Xdm instance and a segmentation fault

** This bug has been flagged as a security vulnerability

-- 
You received this bug notification because you are a member of Zorba
Coders, which is the registrant for Zorba.
https://bugs.launchpad.net/bugs/859968

Title:
  Using put on an attribute produces an invalid Xdm instance and a
  segmentation fault

Status in Zorba - The XQuery Processor:
  New

Bug description:
  The following query creates an element node with a single children
  (not attribute). The attribute is then retrievable using child::node()
  but not attribute::*

  import module namespace doc = "http://www.zorba-
  xquery.com/modules/store/dynamic/documents";

  declare function local:dump-types($nodes as node()*) as element()*
  {
  for $node in $nodes
  return
   if ($node instance of text()) then ()
   else
   (
   element
   {
   if ($node instance of element()) then node-name($node)
   else if ($node instance of attribute()) then concat("attr-",string(node-name($node)))
   else if ($node instance of text()) then 'text'
   else if ($node instance of document-node()) then 'document-node'
   else if ($node instance of comment()) then 'comment'
   else if ($node instance of processing-instruction()) then 'processing-instruction'
   else 'unknown'
   }
   {
    for $attr in $node/@*
     return <attributes>{local:dump-types($attr)}</attributes>,
    for $elem in $node/node()
     return <children>{local:dump-types($elem)}</children>
   }
   )
  };

  put(attribute {"test"}{"test"},"http://www.zorba-xquery.com/b";);
  count(doc:document("http://www.zorba-xquery.com/b";)/child::node()),
  local:dump-types(doc:document("http://www.zorba-xquery.com/b";))

  Returns:

  <?xml version="1.0" encoding="UTF-8"?>
  1<document-node><children><attr-test/></children></document-node>

  Segmentation faults then are easy:

  import module namespace doc = "http://www.zorba-
  xquery.com/modules/store/dynamic/documents";

  declare function local:dump-types($nodes as node()*) as element()*
  {
  for $node in $nodes
  return
  	if ($node instance of text()) then ()
  	else
  	(
  	element 
  	{
  	if ($node instance of element()) then node-name($node)
  	else if ($node instance of attribute()) then concat("attr-",string(node-name($node)))
  	else if ($node instance of text()) then 'text'
  	else if ($node instance of document-node()) then 'document-node'
  	else if ($node instance of comment()) then 'comment'
  	else if ($node instance of processing-instruction()) then 'processing-instruction'
  	else 'unknown'	 
  	}	
  	{
  		for $attr in $node/@*
  			return <attributes>{local:dump-types($attr)}</attributes>,
  		for $elem in $node/node()
  			return <children>{local:dump-types($elem)}</children>			
  	}
  	)
  };

  put(attribute {"test"}{"test"},"http://www.zorba-xquery.com/b";);
  replace node doc:document("http://www.zorba-xquery.com/b";)/child::node() with attribute{"aaa"}{"xxx"};

To manage notifications about this bug go to:
https://bugs.launchpad.net/zorba/+bug/859968/+subscriptions