Uploaded image for project: 'netconf'
  1. netconf
  2. NETCONF-369

Incorrect handling of filter namespaces

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • None
    • None
    • restconf-nb
    • None
    • Operating System: All
      Platform: All

    • 7956

      Current implementation of RESTCONF filters does not handle namespaces correctly, as it performs a namespace-ignorant:

      • XPath parsing
      • XML parsing

      This means that false positives may be encountered when elements differ only by namespace. Quoting https://tools.ietf.org/html/rfc8040#section-4.8.4:

       

      The format of this parameter is an XPath 1.0 expression [XPath] and
       is evaluated in the following context:
      o The set of namespace declarations is the set of prefix and
       namespace pairs for all supported YANG modules, where the prefix
       is the YANG module name and the namespace is as defined by the
       "namespace" statement in the YANG module.
      

       

      But the XPath construction in AbstractQueryParams does not set a proper NamespaceContext. Fix this by supplying a proper NamespaceContext backed by the EffectiveModelContext. Once this is corrected, use UntrustedXML to parse the XML to prevent any shenanigans.

            Unassigned Unassigned
            rovarga Robert Varga
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: