Re: [xacml-users] xpath access control

[Anne Anderson - Sun Microsystems <Anne.Anderson@sun.com>]

Argyn,

[I haven't checked my XPath syntax below, but I hope the idea is clear.]

As an example of the problem, does /A/B[@x="5"]/C
select the same nodeset as /A/B[2]/C ?

They do in document 1, but not in document 2:

Document 1:
   <A>
     <B x="6">
        <C/>
     </B>
     <B x="5">
        <C/>
     </B>
   </A>

Document 2:
   <A>
     <B x="5">
        <C/>
     </B>
     <B x="6">
        <C/>
     </B>
   </A>

The only solution to this problem is limiting your XPath expression 
syntax such that any two expressions select the same nodeset if and only 
if the expressions are syntactically equivalent.  I have no proof, but I 
hypothesize that it is sufficient to require absolute expressions, and 
disallow query operators and element order specifiers.  I would be 
interested in a proof of this or any other proposed limited syntax to 
solve this problem!

[1] proves that the intersection of two XPath expression is equal to an 
XPath expression that merges the constraints at each level: i.e. the 
intersection of the above two is /A/B[@x="5"]&[2]/C (or whatever the 
correct syntax for that is), but that is not the problem to be solved here.

Regards,
Anne Anderson

[1] B.C. Hammerschmidt, M. Kempa, V. Linnemann, "On the Intersection of 
XPath Expressions", Proceedings of the 9th International Database 
Engineering & Application Symposium (IDEAS 2005).  July 2005, Montreal, 
Canada.

Argyn wrote On 11/30/06 11:35,:
> On 11/30/06, Wolfgang Schreiner <wolfgang.schreiner@ec3.at> wrote:
> 
>> Hi all,
>>
>> Following problem: I would like to control access to a set of XML
>> documents via XPath 2.0 queries. XML fragements, which are allowed to
>> being accessed are specified by XPath 2.0 statements as well. What I
>> need is a method to determine whether 2 XPath statements are
>> semantically equal or similar
> 
> 
> i'm not sure what you mean by that. wouldn't a simple regexp match
> work in this case?
> 
>> , before executing the query and having to
>> post-filter the result. What is the best way to achieve this? Does the
>> XACML xpath-node-match function solve this problem?
> 
> 
> it only checks if the resulting nodes are the same, imho. it may not
> be what you are looking for
> 
>> Is there an
>> implementation to it? I think the Sun implementation does not include
>> XPath functions?
> 
> 
> sun and other implementations have xpath functionality as of xacml 2.0
> 
> argyn
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: xacml-users-unsubscribe@lists.oasis-open.org
> For additional commands, e-mail: xacml-users-help@lists.oasis-open.org
> 

-- 
Anne H. Anderson             Email: Anne.Anderson@Sun.COM
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692