Subject: RE: IDMEF 1.0 Element Type Declarations

From: "McMahon, Joseph" <[email-masked]>
Date: Wed, 23 Jan 2002 15:54:40 -0500

You have to consider the difference between:

<Alert>
...
<Foo/>
...
</Alert>

and
 
<Alert>
...
<Alert>

In XML the presence of a tag, even without "data", can be meaningful.  The
first case shows this.  If the intent is to have an element with no data and
not present sometimes, then use the second case.

-- Joe

-----Original Message-----
From: Joe McAlerney [mailto:[email-masked]]
Sent: Wednesday, January 23, 2002 2:31 PM
To: David A. Curry
Cc: Nathan Carey; intrusion detection wg
Subject: Re: IDMEF 1.0 Element Type Declarations

It is valid in XML 1.0, however it is invalid to use start and end tags
with an element declared as EMPTY.  So for an element declared as:

<!ELEMENT Foo EMPTY>

Only <Foo/> would be valid.  <Foo><Foo/> would be invalid.

I guess this means (#PCDATA | EMPTY) is redundant, since #PCDATA allows
for start, end, and empty tags.

-Joe M.

-- 
Joe McAlerney
Software Developer / Security Consultant
[email-masked]
Silicon Defense: IDS Solutions -=- http://www.silicondefense.com/

"David A. Curry" wrote:
> 
> >>>>> On Thu, 24 Jan 2002, Nathan Carey, identified as "Nathan" below,
wrote:
> 
>   Nathan> After messing about with IDMEF 1.0 and a set of tools to allow
XML
>   Nathan> to be placed into /taken out of a database (XMLDBMS) I'm running
>   Nathan> into the problem of the element types Action, Confidence and
Impact
>   Nathan> are declared as having the type (#PCDATA | EMPTY) which I'm
pretty
>   Nathan> certain after trying to find any record of it, is not valid XML.
From
>   Nathan> what I can deduce, the EMPTY data type needs to be defined
earlier in
>   Nathan> the DTD, or it can be used on it's own, but I haven't seen it in
an
>   Nathan> option statement before, and can't find any documentation
supporting
>   Nathan> this.
> 
> I didn't think you could do it either.  And looking at the XML
specification,
> I think the grammar says you can't either.  But they don't actually
discuss
> the issue, so I'm not positive I'm reading it correctly.
> 
> I did run it through two validating parsers (DOMcount and SAXcount from
the
> IBM XML4J/Xerces distribution), and neither of them complained, so I kinda
> assumed it was "legal."
> 
> Is anyone, or does anyone know, an authority on XML syntax?
> 
> If it turns out that this is not allowed, we may be able to remove "EMPTY"
> from the declaration, because XML specifically does permit empty element
> tags to be used for any element that has no content, regardless of whether
> it is declared as empty.
> 
> --Dave

---

From: Joe McAlerney <[email-masked]>
Date: Wed, 23 Jan 2002 13:21:12 -0800

I agree.  My point was that an element defined as EMPTY will never have
content, where one defined as #PCDATA may or may not have content.

<!ELEMENT Foo EMPTY>
<!ATTLIST Foo
  attribute	CDATA	'0'

<!ELEMENT Bar #PCDATA>
<!ATTLIST Bar
  attribute	CDATA	'0'

...

<Foo/>                // valid
<Foo attribute=0 />   // valid
<Foo>content</Foo>    // INVALID

<Bar/>                // valid
<Bar attribute=0 />   // valid
<Bar>content</Bar>    // valid

-Joe M.