Subject: IDMEF 1.0 Element Type Declarations

From: "Nathan Carey" <[email-masked]>
Date: Thu, 24 Jan 2002 00:22:41 +1000

Hello Everyone,

After messing about with IDMEF 1.0 and a set of tools to allow XML to be
placed into /taken out of a database (XMLDBMS) I'm running into the problem
of the element types Action, Confidence and Impact are declared as having
the type (#PCDATA | EMPTY) which I'm pretty certain after trying to find any
record of it, is not valid XML. From what I can deduce, the EMPTY data type
needs to be defined earlier in the DTD, or it can be used on it's own, but I
haven't seen it in an option statement before, and can't find any
documentation supporting this.

Can Mssrs Debar or Curry please enlighten me on this point?

Regards,

Nathan Carey

---

From: "David A. Curry" <[email-masked]>
Date: Wed, 23 Jan 2002 10:05:55 -0500

>>>>> On Thu, 24 Jan 2002, Nathan Carey, identified as "Nathan" below, wrote:

  Nathan> After messing about with IDMEF 1.0 and a set of tools to allow XML
  Nathan> to be placed into /taken out of a database (XMLDBMS) I'm running
  Nathan> into the problem of the element types Action, Confidence and Impact
  Nathan> are declared as having the type (#PCDATA | EMPTY) which I'm pretty
  Nathan> certain after trying to find any record of it, is not valid XML. From
  Nathan> what I can deduce, the EMPTY data type needs to be defined earlier in
  Nathan> the DTD, or it can be used on it's own, but I haven't seen it in an
  Nathan> option statement before, and can't find any documentation supporting
  Nathan> this.

I didn't think you could do it either.  And looking at the XML specification,
I think the grammar says you can't either.  But they don't actually discuss
the issue, so I'm not positive I'm reading it correctly.

I did run it through two validating parsers (DOMcount and SAXcount from the
IBM XML4J/Xerces distribution), and neither of them complained, so I kinda
assumed it was "legal."

Is anyone, or does anyone know, an authority on XML syntax?

If it turns out that this is not allowed, we may be able to remove "EMPTY"
from the declaration, because XML specifically does permit empty element
tags to be used for any element that has no content, regardless of whether
it is declared as empty.

--Dave

---

From: Joe McAlerney <[email-masked]>
Date: Wed, 23 Jan 2002 11:30:30 -0800

It is valid in XML 1.0, however it is invalid to use start and end tags
with an element declared as EMPTY.  So for an element declared as:

<!ELEMENT Foo EMPTY>

Only <Foo/> would be valid.  <Foo><Foo/> would be invalid.

I guess this means (#PCDATA | EMPTY) is redundant, since #PCDATA allows
for start, end, and empty tags.

-Joe M.

-- 
Joe McAlerney
Software Developer / Security Consultant
[email-masked]
Silicon Defense: IDS Solutions -=- http://www.silicondefense.com/