Re: [wss] Issue 389: Detection of Duplicate IDs

[Rich Salz <rsalz@datapower.com>]

> 1) It doesn't detect the case where two attributes *with different
> names* both contain a relevant ID.

I've been thinking/worrying about this for a while, as have others (Mike 
Macintosh in the WS-I list, e.g.).

I'm no longer sure it's an issue for the security layer.

If someone possesses *all* the schema's, then they will detect that 
there are duplicate ID attributes.  But if the security layer doesn't 
have all the schemas, and/or doesn't do schema validation, then it won't 
see the conflict.  (If an ID falls in the forest...)

The security layer, however, will see only the ID attributes it knows 
about -- wsu:ID, probably xml:id -- and find the right thing.  If it 
knows of other ID attributes, and one of them shares the same value, it 
will fail.  This is a DOS, which historically we in the security arena 
tend to consider "not very important." :)

I think a solution is to say that "the target of @ds:Reference/URI 
SHOULD be wsu:id (or xml:id)" attributes.  Closely-coupled applications 
may violate the SHOULD.

> Did anyone suspect that [ID attributes] was going to cause this much trouble?

I wasn't there, but I've had email and conf calls with the XML core WG. 
  They didn't -- and still don't -- see it as an issue.  Their mindset 
is that you have the entire DTD and/or set of schemas in-hand.  This 
comes from the SGML background of most of the XML inventors. 
Loosly-coupled isn't in their vocabulary.

	/r$

-- 
Rich Salz, Chief Security Architect
DataPower Technology                           http://www.datapower.com
XS40 XML Security Gateway   http://www.datapower.com/products/xs40.html