[SANTUARIO-526] XMLSecStartDocumentImpl returns null version instead of default "1.0"

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Java 2.1.4
• Fix Version/s: Java 2.2.0, Java 2.1.5
• Component/s: Java
• Assignee: Colm O hEigeartaigh
• Reporter: Peter De Maeyer
• Created: 14/Feb/20 06:35
• Updated: 13/Mar/20 12:26
• Resolved: 06/Mar/20 10:11

Description

While debugging XMLSecurityStreamReaderTest.testCorrectness, I noticed some inconsistencies/bugs in XMLSecStartDocumentImpl.

As per Javadoc of StartDocument, getVersion() should default to "1.0" when undefined. However, the value can be null because it's assigned in the constructor. The initial value "1.0" is never used. The fix is obvious, but would bring it out of sync with the XMLStreamReader.getVersion API, which per Javadoc is supposed to return null to indicate the default value. The current behavior also has a rationale to it, so we should be careful when changing this behavior - it will make some tests fail.

XMLStreamReader (not the Santuario one, but the underlying Woodstox one) seems to be emitting StartDocument events for documents that don't have a document declaration. I believe this to be wrong, although I'm not 100% sure yet. It preempts the caller from being able to make the distinction between "there is no document declaration" and "there is a document declaration with version and encoding set to the defaults". Not being able to make that distinction means that the output document can't represent the input document 100% accurately.

It seems to me that the spirit of the API is this:

1. XMLStreamReader reflects what's defined in the actual document. If there is no document declaration, then getVersion, getCharacterEncodingScheme return null to tell the caller "no document declaration, use the defaults" while allowing the caller to still make the distinction with "there is a document declaration, but the values are the defaults".
2. StartDocument is an event which is supposed to be emitted only when there is an actual document declaration being parsed.

I'll investigate this a bit more and propose a fix.