Problem with XQuery validation

[martindholmes]

I've just upgraded to the latest Oxygen (XML Editor 17.1, build 2015111718), and a problem has popped up with automated XQuery validation. I have the default setting for XQuery validation (Saxon-PE XQuery 9.6.0.7), and when I save an XQuery file, I get a series of prompts like this:

The XQuery validator null tries to connect to www.oasis-open.org:80.
The host www.oasis-open.org:80 is not in the list of trusted hosts.
Do you want to allow the connection to this host?

The XQuery validator null tries to connect to 192.237.193.98:80.
The host 192.237.193.98:80 is not in the list of trusted hosts.
Do you want to allow the connection to this host?

I have three options: Allow, Allow and remember, and Reject. Since I don't really understand what's happening here, I'm not prepared to hit "Allow and remember", but if I hit either of the other options, the prompts keep on popping up. This makes it impossible to exit from the app without force-killing it.

The 192 ip address comes back to Rackspace, but presumably they're acting as a cloud/loadbalancing service for someone else, not listed.

Any ideas what's causing this?

Cheers,
Martin

[Radu]

Hi Martin,

In Oxygen 17.1 we added some security control in the application, among which letting the end user know when the XSLT or XQuery engine tries to connect to a remote site.
That null part of the message looks like something we fixed in the latest 17.1. But as you are already using it, maybe we missed certain aspects. I'll be back with a followup post on this.

So your XQuery script is local, right? I'm not sure why Saxon connects to that website on save. Possibly that when saving validation is also performed, which means that we use Saxon to compile the XQuery and see if the compilation returns any error. Does the XQuery script in itself has places where it tries to connect to a remote server?

Regards,
Radu

[martindholmes]

HI Radu,

It's a local XQuery script, and it doesn't make any external calls, although it does define some eXist-specific namespaces. I've also seen another thing that might be a symptom of the same sort of problem, when editing an Ant build.xml file:

Code: Select all

<<Ant validation should not write on disk. It tried to write to: /home/mholmes/Oxygen XML Editor 17/output.log. This is not allowed for security reasons.>>

Severity

Error

System ID

/media/Data/WorkData/ise/svnrepo/trunk/ise-tei/sgml-to-tei/build.xml

Main validation file

/media/Data/WorkData/ise/svnrepo/trunk/ise-tei/sgml-to-tei/build.xml

Engine name

ANT Validator

The Oxygen process would actually have the right to write to files there; I have Oxygen in my home directory and the output.log file is writable.

Cheers,
Martin

[alex_jitianu]

Hi Martin,

This second issue is also related to our security checks. The validation of an ANT script shouldn't have any need to write to the file system. In your case though,it is our internal logging which tries to do that and it is wrongfully stopped.

Both of these issues (The ANT and the null part of XQuery validation message), though, should have been fixed in the latest 17.1 build. Can you please double check that you are running the 2015111718 build? The best way to check is to go to Help->About and the build id is in the very first line from the Copyright tab.

Another thing to consider is the fact that the log system is enabled and that could introduce performance penalties. To disable the log, please remove log4j.properties from the Oxygen installation directory.

Best regards,
Alex

[martindholmes]

Hi Alex,

I am using the latest: XML Editor 17.1, build 2015111718

but I haven't seen the problem again in the last couple of days. Maybe a reboot might have changed something?

Cheers,
Martin