[XERCESC-1713] external-schemaLocation property does not override the schema location attribute in the instance

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7.0
• Fix Version/s: 3.1.0
• Component/s: Validating Parser (XML Schema)
• Environment: any
• Assignee: Unassigned
• Reporter: Boris Kolpackov
• Created: 21/Jun/07 18:06
• Updated: 18/Nov/09 07:55
• Resolved: 18/Nov/09 07:55

Description

The documentation for the external-schemaLocation and external-noNamespaceSchemaLocation properties state that if specified, the instance document's schemaLocation and noNamespaceSchemaLocation attributes will be effectively ignored. This appears not to be the case. If the schema specified with the external-* properies can not be opened, the parser proceeds to try paths from the schemaLocation and noNamespaceSchemaLocation attributes. I think this does not make much sense and is actually a potential security threat. Normally if one specifies the schema location with the external-* properties they don't want the values from the instance to have any effect.