[xml] file path vs URI

[Petr Sumbera <Petr Sumbera Sun COM>]

Hi guys,

Sorry for maybe not well described or at least strange formulation as 
I'm not XML expert at all.

In UNIX systems file path starting with "//" is being accepted and it's 
processed without complaining. For example:

"cat //etc/passwd" will show content of /etc/passwd

But this seems to be against URI (RFC 2396) or at least its 
implementation in libxml2.

http://www.ietf.org/rfc/rfc2396.txt

libxml2 understands such path/URI(?) as Relative reference where "//" is 
 understood as network. RFC 2396 says about Relative reference in 
chapter 1.4 following:

"In contrast, a relative identifier refers to a resource by describing 
the difference within a hierarchical namespace between the current 
context and an absolute identifier of the resource."

Does libxml2 really follow up this? There seems to be simple fall back 
from Absolute reference to Relative (in xmlParseURIReference()). I don't 
see context anywhere.

Simple example why I'm concerned:

-bash-3.2$ head -n 2 /var/svc/manifest/network/ntp.xml
<?xml version="1.0"?>
<!DOCTYPE service_bundle SYSTEM 
"/usr/share/lib/xml/dtd/service_bundle.dtd.1">
-bash-3.2$ xmllint --valid --noout //var/svc/manifest/network/ntp.xml
//var/svc/manifest/network/ntp.xml:2: I/O error : failed to load 
external entity "//var/usr/share/lib/xml/dtd/service_bundle.dtd.1"
<!DOCTYPE service_bundle SYSTEM 
"/usr/share/lib/xml/dtd/service_bundle.dtd.1">

       ^
//var/svc/manifest/network/ntp.xml:2: warning: failed to load external 
entity "//var/usr/share/lib/xml/dtd/service_bundle.dtd.1"
<!DOCTYPE service_bundle SYSTEM 
"/usr/share/lib/xml/dtd/service_bundle.dtd.1">

       ^
//var/svc/manifest/network/ntp.xml:15: validity error : Validation 
failed: no DTD found !
<service_bundle type='manifest' name='SUNWntpr:xntpd'>
                                                     ^
-bash-3.2$

---

Note that DTD is searched in wrong path 
"//var/usr/share/lib/xml/dtd/service_bundle.dtd.1" instead of 
"/usr/share/lib/xml/dtd/service_bundle.dtd.1" (basically var is 
considered as server)

It may be problem of xmllint of not converting (sanitizing) path into 
URI. Is it?

And why I'm bothering about all of this? We have some utility which 
suffers with the same symptoms after updating libxml2 from 2.6.10 to 
2.6.23. As it uses such functions like xmlReadFile (where on input is 
filename) it can be similar to problem described above. The difference 
is that the problem described above was there even in 2.6.10, while in 
this version our utility was ok. Any idea here?

Thanks for any comment,

Petr