Re: [xml-dev] Why is < illegal in an attribute value but theequivalent h

[David Carlisle <d.p.carlisle@gmail.com>]

On Wed, 16 Mar 2022 at 23:00, Roger L Costello <costello@mitre.org> wrote:

Hi Folks,

For the parser that I am building I need to be sure that I know exactly what can (and can't) go within an attribute value. For example, can an attribute value contain &amp;? (Yes) Can an attribute value contain the greater-than symbol? (Yes)

I created tests to see what characters are legal and what are illegal in an attribute value. See below.

Questions:
1. Why is it that < is illegal but the equivalent hex and decimal character entities are legal?

it stops you being creative with  <something foo="<b>xyz</b>"/>

2. Are there unusual things that are legal (or illegal) to put in an attribute value? For instance, you can't put a CDATA section or a PI in an attribute value, right?

That follows from the first point, you can't have a < so you can't have a <![CDATA

You also can't have a literal " and a literal '  (one of them has to be quoted as an entity or character reference)

 

3. (Extra credit) Do you have C code that converts a hex or decimal character entity to its character? E.g., &#x41 --> C code --> 'A'

<Tests>
    <Test foo="&amp;"/>         <!-- Okay -->
    <Test foo="&lt;"/>                  <!-- Okay -->
    <Test foo="&gt;"/>          <!-- Okay -->
    <Test foo="&quot;"/>        <!-- Okay -->
    <Test foo="&apos;"/>        <!-- Okay -->
    <Test foo="'"/>                     <!-- Okay --> 
    <Test foo="""/>                      <!-- Error -->
    <Test foo="<"/>                     <!-- Error -->
    <Test foo="&#x3C;"/>        <!-- x3C = < ........... Why is this Okay? -->

why not?

 

    <Test foo="&#60;"/>         <!-- 60  = < ........... Why is this Okay? -->

why not?

 

    <Test foo=">"/>                     <!-- Okay -->
    <Test foo="&#x0;"/>         <!-- x0 = NUL ........... Error -->
    <Test foo="&#x1;"/>         <!-- x1 = SOH ........... Error -->

OK in XML 1.1 (if you believe in that)

    <Test foo="&#x2;"/>         <!-- x2 = STX ........... Error -->
    <Test foo="&#x3;"/>         <!-- x3 = ETX ........... Error -->
    <Test foo="&#x4;"/>         <!-- x4 = EOT ........... Error -->
    <Test foo="&#x5;"/>         <!-- x5 = ENQ ........... Error -->
    <Test foo="&#x6;"/>         <!-- x6 = ACK ........... Error -->
    <Test foo="&#x7;"/>         <!-- x7 = BEL ........... Error -->
    <Test foo="&#x8;"/>         <!-- x8 = BS ........... Error -->

as above

    <Test foo="&#x9;"/>         <!-- x9 = TAB ........... Okay -->
    <Test foo="&#xA;"/>         <!-- xA = LF ........... Okay -->
    <Test foo="&#xB;"/>         <!-- xB = VT ........... Error -->
    <Test foo="&#xC;"/>         <!-- xC = FF ........... Error -->
    <Test foo="&#xD;"/>         <!-- xD = CR ........... Okay -->
    <Test foo="&#xE;"/>         <!-- xE = SO ........... Error -->
    <Test foo="&#xF;"/>         <!-- xF = SI ........... Error -->
    <Test foo="&#x10;"/>        <!-- x10 = DLE ........... Error -->
    <Test foo="&#x11;"/>        <!-- x11 = DC1 ........... Error -->
    <Test foo="&#x12;"/>        <!-- x12 = DC2 ........... Error -->
    <Test foo="&#x13;"/>        <!-- x13 = DC3 ........... Error -->
    <Test foo="&#x14;"/>        <!-- x14 = DC4 ........... Error -->
    <Test foo="&#x15;"/>        <!-- x15 = NAK ........... Error -->
    <Test foo="&#x16;"/>        <!-- x16 = SYN ........... Error -->
    <Test foo="&#x17;"/>        <!-- x17 = ETB ........... Error -->
    <Test foo="&#x18;"/>        <!-- x18 = CAN ........... Error -->
    <Test foo="&#x19;"/>        <!-- x19 = EM ........... Error -->
    <Test foo="&#x1A;"/>        <!-- x1A = SUB ........... Error -->
    <Test foo="&#x1B;"/>        <!-- x1B = ESC ........... Error -->
    <Test foo="&#x1C;"/>        <!-- x1C = FS ........... Error -->
    <Test foo="&#x1D;"/>        <!-- x1D = GS ........... Error -->
    <Test foo="&#x1E;"/>        <!-- x1E = RS ........... Error -->
    <Test foo="&#x1F;"/>        <!-- x1F = US ........... Error -->

all OK in 1.1

    <Test foo="&#x20;"/>        <!-- x20 = Space ........... Okay -->
</Tests>

rxp for example flags an error with

<Test foo="&#x19;"/>

but not with

<?xml version="1.1"?>
<Test foo="&#x19;"/>

Actually the rules for entity references in attributes in the main document are pretty straight forward, it's the rules about when combinations of general and parameter entity rules are expanded within a DTD that are "interesting" so for example you could

test your parser by checking which of these is right:

<!DOCTYPE x SYSTEM "at.dtd">
<x>&a;</x>

where at.dtd is

<!ENTITY % pa "<!ENTITY">
<!ENTITY % plt "&#60;">

%pa; a "%plt;a q='2'/>">

parsing with rxp and xmllint

$ rxp -x at2.xml
<x><a q="2"></a></x>

$ xmllint --loaddtd at2.xml
at.dtd:4: parser error : Entity declaration doesn't start and stop in the same entity
%pa; a "%plt;a q='2'/>">
                       ^

David