[xml] bug in xpath/xpointer ids processing?

[Aleksey Sanin <aleksey aleksey com>]

Hi, Daniel!

One of xmlsec users reported a problem with "id()" xpath function
when id attribute contains a plus sign. For example,

    [aleksey lsh gnome-xml]$ cat test.xml
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE test [
    <!ATTLIST Test id ID #IMPLIED>
    ]>
    <Root>
        <Test id="a+b">
            Hello!
        </Test>
    </Root>

    [aleksey lsh gnome-xml]$ ./testXPath --input test.xml "id('a+b')"
    Object is a Node Set :
    Set contains 0 nodes:

As far as I can understand "id()" function description (section 4.1 of 
XPath 1.0 spec),
the id attribute "a+b" is perfectly valid. And I believe that the 
problem is caused by
the second loop in xmlXPathGetElementsByIds() function:
  
       while ((IS_LETTER(*cur)) || (IS_DIGIT(*cur)) ||
              (*cur == '.') || (*cur == '-') ||
              (*cur == '_') || (*cur == ':') ||
              (IS_COMBINING(*cur)) ||
              (IS_EXTENDER(*cur)))
              cur++;

As far as I can understand, it should be replaced with

        while ((!IS_BLANK(*cur)) && (*cur != 0))  
             cur++;

(according to comment before this function, "ids:  a whitespace 
separated list of IDs").
After making this change, all the XPath and XPointer regression LibXML 
tests are OK
as well as all the XMLSec regression tests.

I wonder what is your opinion on this because I just do not have enough 
knowledge of
xpath internals to assure myself that it's a correct change.


Thank you in advance,
Aleksey




Index: xpath.c
===================================================================
RCS file: /cvs/gnome/gnome-xml/xpath.c,v
retrieving revision 1.218
diff -r1.218 xpath.c
5871,5878c5871,5872
<       while ((IS_LETTER(*cur)) || (IS_DIGIT(*cur)) ||
<              (*cur == '.') || (*cur == '-') ||
<              (*cur == '_') || (*cur == ':') || 
<              (IS_COMBINING(*cur)) ||
<              (IS_EXTENDER(*cur)))
<              cur++;
< 
<       if ((!IS_BLANK(*cur)) && (*cur != 0)) break;
---
>       while((!IS_BLANK(*cur)) && (*cur != 0)) 
>           cur++;