Nabble - eXist

Re: XProc: "No request object found in the current XQuery context." when using "request:get-parameter-names()"

2009-11-27T14:04:16Z

Now i've compiled the latest stable release (from /exist 1.4.x) and I copied the file xprocxq.jar from this release to the main one (1.4.0), but still not working.

It is not enough to copy xprocxq.jar?

Claudius Teodorescu

From forum: exist-open

Invalid character in entity name (=) or missing ;

2009-11-27T09:42:54Z

I have an extension which returns strings that look like xml and need to be treated like xml. They look something like this:

<entry>
<title>cheese</title>
<url>www.cheese.com</url>
<more>text</more>
</entry>

Here is the code I use to call the function and get the $result_string:
for $result_string in gsa:query($input)
let $result := util:eval($result_string)

I use eval() so I can use xQuery to format the results and do a few other things...

Problem:
The above works fine, but for some reason if I have a url like...
<url>www.cheese.com?variety=american&state=WI</url>
I get the following error:

Invalid character in entity name (=) or missing ;

Is there something I can do about that? It doesn't seem right to me... Why would an '=' in element data throw an error? Is there something else I'm not seeing?

Any help is appreciated. Thanks>

From forum: exist-open

Re: Where are the current admin client favorites stored?

2009-11-27T08:02:36Z

Hi,

On Fri, Nov 27, 2009 at 4:25 PM, Thomas White <thomas.0007@...> wrote:
> I would like to know how can I save the admin client favorites, so when I
> uninstall a previous version of eXist and install the next one, I can copy
> the favorites and re-use them.

The settings are stored using the Java Preferences API, the actual
storage is the registry for Windows, somewhere in your homedirectory
for the unixes....

regards

Dannes

--
eXist-db Native XML Database - http://exist-db.org
Join us on linked-in: http://www.linkedin.com/groups?gid=35624

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: error while executing update query

2009-11-27T07:39:20Z

What is the expected release date of 1.4.1 and secondly is there a nightly build of current snapshot available for download?

Thanks

Shiraz

On Thu, Nov 26, 2009 at 3:52 PM, Dmitriy Shabanov <shabanovd@...> wrote:

1.4.1 on a way

--
Cheers,

Dmitriy Shabanov

On Thu, 2009-11-26 at 15:48 +0100, shiraz memon wrote:
> Thanks Dmitriy,
>
>
>
> by checking out the latest eXist source from sf.net svn, building and
> then replacing the produced jars inside already existing eXist
> installation enables the successful xquery update. However, I am not
> sure if this solution is really tempting for the eXist end users.
>
>
> Cheers
> Shiraz
>
> On Thu, Nov 26, 2009 at 2:31 PM, Dmitriy Shabanov
> <shabanovd@...> wrote:
> Can you check stable/eXist-1.4.x on svn? (to make sure it fix)
>
> --
> Cheers,
>
> Dmitriy Shabanov
>
> On Thu, 2009-11-26 at 14:03 +0100, shiraz memon wrote:
> > On Thu, Nov 26, 2009 at 1:50 PM, Dmitriy Shabanov
> > <shabanovd@...> wrote:
> > What eXist do you use?
> >
> >
> > Its the latest greatest from exist-db website, which is
> > eXist-setup-1.4.0-rev10440.
> >
> >
> > Best regards,
> > Shiraz
> >
> > --
> > Cheers,
> >
> > Dmitriy Shabanov
> >
> > On Thu, 2009-11-26 at 13:38 +0100, shiraz memon
> wrote:
> > > Ok, I just passed through the eXist mail archive
> and saw the
> > same
> > > issue posted on Nov 25. Are the changes included
> inside the
> > stable
> > > release of exist v1.4 (as I can see on
> > >
> >
> http://exist.svn.sourceforge.net/viewvc/exist?view=rev&revision=10589,
> > > that it is already been fixed)?
> > >
> > >
> > >
> > > Shiraz
> > >
> > > On Thu, Nov 26, 2009 at 12:55 PM, shiraz memon
> > > <shiraz.lists@...> wrote:
> > > Hi,
> > >
> > >
> > >
> > > I am getting errors/exceptions while
> executing
> > xupdate on a
> > > xml document. The query being evaluated
> is:
> > >
> > >
> > > update value //*:Name with 'date'
> > >
> > >
> > > The xml document is:
> > >
> > >
> > > <Application>
> > > <Name>perl</Name>
> > > <Version>2</Version>
> > > <Location>/bin/perl</Location>
> > > </Application>
> > >
> > >
> > >
> > > and finally the trace copied from eXist
> client Query
> > browser:
> > >
> > >
> > > org.xmldb.api.base.XMLDBException: Array
> index out
> > of range:
> > > -1
> > > at
> > >
> >
> org.exist.xmldb.LocalXPathQueryService.execute(LocalXPathQueryService.java:387)
> > > at
> > >
> >
> org.exist.xmldb.LocalXPathQueryService.execute(LocalXPathQueryService.java:136)
> > > at org.exist.client.QueryDialog
> > > $QueryThread.run(QueryDialog.java:473)
> > > Caused by:
> java.lang.ArrayIndexOutOfBoundsException:
> > Array
> > > index out of range: -1
> > > at
> >
> org.exist.storage.NodePath.getComponent(NodePath.java:104)
> > > at
> > >
> >
> org.exist.indexing.lucene.LuceneConfig.matches(LuceneConfig.java:37)
> > > at
> > >
> >
> org.exist.indexing.lucene.LuceneIndexWorker.getReindexRoot(LuceneIndexWorker.java:178)
> > > at
> > >
> >
> org.exist.indexing.IndexController.getReindexRoot(IndexController.java:265)
> > > at
> >
> org.exist.dom.ElementImpl.update(ElementImpl.java:1272)
> > > at
> > org.exist.xquery.update.Update.eval(Update.java:156)
> > > at
> > >
> >
> org.exist.xquery.AbstractExpression.eval(AbstractExpression.java:61)
> > > at
> org.exist.xquery.PathExpr.eval(PathExpr.java:241)
> > > at
> > >
> >
> org.exist.xquery.AbstractExpression.eval(AbstractExpression.java:61)
> > > at
> org.exist.xquery.XQuery.execute(XQuery.java:228)
> > > at
> org.exist.xquery.XQuery.execute(XQuery.java:183)
> > > at
> > >
> >
> org.exist.xmldb.LocalXPathQueryService.execute(LocalXPathQueryService.java:380)
> > > ... 2 more
> > > Caused by:
> java.lang.ArrayIndexOutOfBoundsException:
> > Array
> > > index out of range: -1
> > > at
> >
> org.exist.storage.NodePath.getComponent(NodePath.java:104)
> > > at
> > >
> >
> org.exist.indexing.lucene.LuceneConfig.matches(LuceneConfig.java:37)
> > > at
> > >
> >
> org.exist.indexing.lucene.LuceneIndexWorker.getReindexRoot(LuceneIndexWorker.java:178)
> > > at
> > >
> >
> org.exist.indexing.IndexController.getReindexRoot(IndexController.java:265)
> > > at
> >
> org.exist.dom.ElementImpl.update(ElementImpl.java:1272)
> > > at
> > org.exist.xquery.update.Update.eval(Update.java:156)
> > > at
> > >
> >
> org.exist.xquery.AbstractExpression.eval(AbstractExpression.java:61)
> > > at
> org.exist.xquery.PathExpr.eval(PathExpr.java:241)
> > > at
> > >
> >
> org.exist.xquery.AbstractExpression.eval(AbstractExpression.java:61)
> > > at
> org.exist.xquery.XQuery.execute(XQuery.java:228)
> > > at
> org.exist.xquery.XQuery.execute(XQuery.java:183)
> > > at
> > >
> >
> org.exist.xmldb.LocalXPathQueryService.execute(LocalXPathQueryService.java:380)
> > > at
> > >
> >
> org.exist.xmldb.LocalXPathQueryService.execute(LocalXPathQueryService.java:136)
> > > at org.exist.client.QueryDialog
> > > $QueryThread.run(QueryDialog.java:473)
> > >
> > >
> > > Thanks in advance for any help.
> > >
> > >
> > > Shiraz
> > >
> >
> > >
> >
> ------------------------------------------------------------------------------
> > > Let Crystal Reports handle the reporting - Free
> Crystal
> > Reports 2008 30-Day
> > > trial. Simplify your report design, integration
> and
> > deployment - and focus on
> > > what you do best, core application coding.
> Discover what's
> > new with
> > > Crystal Reports now.
> http://p.sf.net/sfu/bobj-july
> > > _______________________________________________
> Exist-open
> > mailing list Exist-open@...
> >
> https://lists.sourceforge.net/lists/listinfo/exist-open
> >
> >
> >
>
>
>
>

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Where are the current admin client favorites stored?

2009-11-27T07:25:17Z

I would like to know how can I save the admin client favorites, so when I
uninstall a previous version of eXist and install the next one, I can copy
the favorites and re-use them.

Thomas

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: Performance/Indexing question...

2009-11-27T06:43:28Z

On Fri, Nov 27, 2009 at 3:35 PM, Andrzej Jan Taramina
<andrzej@...> wrote:
> I'm trying to optimize some of our query code, and have a function that
> basically does something like this:
>
> exists( collection( ...)[ some predicates ] )

would be useful to have some example predicates .... a lot of times
exists() can be rewritten to take advantage of 'early exit' ... if
eXist is doing this rewriting is another question.

> all of the predicates have range indexes, so the lookup should be fast.
>
> But does eXist load the whole document for the predicate match from the
> DB, create the sequence and then apply the exists() function?
>
> Since we don't care about retrieving the documents, just if they exist
> or not, I was wondering what was going on under the covers, since
> retrieving many large documents is probably adding a lot of time to our
> query, and thus driving 30 second response times in the particular case,
> since we will call this function 100 times for a particular user query
> scenario.
>
> Would there be an alternative way to determine the existence of a
> document matching our indexed predicates, where it only uses the index
> and doesn't ever retrieve the full document?

you could retrieve the xml from calling the collection via the RESTful
interface (which would be the directory listing) ... if this is
smaller then your doc/docs then this maybe 'cheaper' to process.

Jim Fuller

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Performance/Indexing question...

2009-11-27T06:35:25Z

I'm trying to optimize some of our query code, and have a function that
basically does something like this:

exists( collection( ...)[ some predicates ] )

all of the predicates have range indexes, so the lookup should be fast.

But does eXist load the whole document for the predicate match from the
DB, create the sequence and then apply the exists() function?

Since we don't care about retrieving the documents, just if they exist
or not, I was wondering what was going on under the covers, since
retrieving many large documents is probably adding a lot of time to our
query, and thus driving 30 second response times in the particular case,
since we will call this function 100 times for a particular user query
scenario.

Would there be an alternative way to determine the existence of a
document matching our indexed predicates, where it only uses the index
and doesn't ever retrieve the full document?

Thanks!

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: Transaction support

2009-11-27T06:27:19Z

2009/11/27 Markku Laine <mplaine@...>:
> Just out of curiosity, as I am not a database expert, what is the main
> reason not to provide transaction support on the (XQJ) API level in
> eXist-db?

It's usually very hard to provide rollback for some transactions but
not others unless the database's storage system has been designed to
do that from the start. eXist's storage system appears to have been
designed to provide recovery, not user rollback. No matter how good a
developer you are - and the eXist developers appear to be very good! -
changes like this are very likely to introduce bugs into the
transactions system that is used to recover the database after a dirty
shut down.

So I suspect the main reasons not to provide this are "It's a lot of
work to do it at all" and "We will be messing with one of the key
areas of the database engine, which means a *very* large amount of
testing to make sure we've not broken anything by adding this feature,
or lots of angry users when their databases break in unexpected ways
and they can't recover them".

- Peter

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: Transaction support

2009-11-27T05:58:09Z

Markku,

> Just out of curiosity, as I am not a database expert, what is the main
> reason not to provide transaction support on the (XQJ) API level in
> eXist-db?

As I tried to explain in my response: "The purpose of the current
system is to make sure the database can be restored to a consistent
state after a crash (by redoing/undoing transactions)." In other
words: the current implementation of transactions within eXist is
targeted at crash recovery and nothing else. You cannot roll back a
transaction - except after a crash.

Wolfgang

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: Transaction support

2009-11-27T05:44:01Z

Wolfgang,

On 27.11.2009, at 14.29, Wolfgang Meier wrote:

> Hi,
>
>> Does eXist-db support transactions and/or XQJ API?
>
> As described elsewhere, eXist does use transactions on the storage
> level internally, but they are not accessible through any interface.
> The purpose of the current system is to make sure the database can be
> restored to a consistent state after a crash (by redoing/undoing
> transactions). It does not support user defined transactions or
> rollbacks at runtime.
>
> Adam started to implement transactions on a higher level, but as he
> said before, his project is still in an early phase and will take
> quite some more time until anything is practically usable.
>
>> At the moment, I am using XML:DB API but it does not provide any
>> transaction support, am I right? AFAIK XQJ API provides transaction
>> support and noticed that the implementation of it is/was in progress
>> at some point in the past. What is the current status/schedule of it?
>
> XQJ will be coming (though not all of us are happy with the design of
> the standard). I think Dannes and Adam just started to look into it
> again this week. However, our implementation will definitely not
> support the transaction methods.

Thanks for your prompt answer!

Just out of curiosity, as I am not a database expert, what is the main
reason not to provide transaction support on the (XQJ) API level in
eXist-db?

Have a nice weekend!

-Markku

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: Transaction support

2009-11-27T04:29:41Z

Hi,

> Does eXist-db support transactions and/or XQJ API?

As described elsewhere, eXist does use transactions on the storage
level internally, but they are not accessible through any interface.
The purpose of the current system is to make sure the database can be
restored to a consistent state after a crash (by redoing/undoing
transactions). It does not support user defined transactions or
rollbacks at runtime.

Adam started to implement transactions on a higher level, but as he
said before, his project is still in an early phase and will take
quite some more time until anything is practically usable.

> At the moment, I am using XML:DB API but it does not provide any
> transaction support, am I right? AFAIK XQJ API provides transaction
> support and noticed that the implementation of it is/was in progress
> at some point in the past. What is the current status/schedule of it?

XQJ will be coming (though not all of us are happy with the design of
the standard). I think Dannes and Adam just started to look into it
again this week. However, our implementation will definitely not
support the transaction methods.

Wolfgang

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Transaction support

2009-11-27T02:49:43Z

Hi all,

Does eXist-db support transactions and/or XQJ API? All I could find
were these:
http://exist.sourceforge.net/facts.html
http://exist.sourceforge.net/xquery.html#N106E4

At the moment, I am using XML:DB API but it does not provide any
transaction support, am I right? AFAIK XQJ API provides transaction
support and noticed that the implementation of it is/was in progress
at some point in the past. What is the current status/schedule of it?

Kind regards

-Markku

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XProc: "No request object found in the current XQuery context." when using "request:get-parameter-names()"

2009-11-27T01:17:51Z

Claudius,

v1.4 is the latest official release version of eXist ... whilst xproc
is in there its not the latest version of xproc ... latest work is
always in the /trunk in subversion source control.

To use this binding feature (and any new stuff) you will need to
download (using svn checkout) eXist and build yourself or wait for the
next official release of eXist (which will be some time .... ).

I think you can find relevant instructions

http://exist.sourceforge.net/building.html

under 'Using the Subversion Repository'

good luck, Jim Fuller

On Fri, Nov 27, 2009 at 10:09 AM, Claudius Teodorescu
<claud108@...> wrote:

> Once again, thank you for your help, Jim.
>
> I really appreciate it.
>
> I've tested exactly as you said, but it is not working. :(
>
> I have exist 1.4.0.
>
>
> Claudius Teodorescu
>
>
>
>
>

From forum: exist-open

Re: XProc: "No request object found in the current XQuery context." when using "request:get-parameter-names()"

2009-11-27T01:09:28Z

Once again, thank you for your help, Jim.

I really appreciate it.

I've tested exactly as you said, but it is not working. :(

I have exist 1.4.0.

Claudius Teodorescu

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XProc: "No request object found in the current XQuery context." when using "request:get-parameter-names()"

2009-11-27T00:34:56Z

ok to pass in data via bindings I have added some brief doc to xproc
but repeat here:

take pidentity.xproc

<p:pipeline xmlns:c="http://www.w3.org/ns/xproc-step"
xmlns:p="http://www.w3.org/ns/xproc" name="pipeline">
<p:identity>
<p:input port="source">
<p:pipe step="pipeline" port="a"/>
</p:input>
</p:identity>
</p:pipeline>

and call this xproc using this url

http://127.0.0.1:8080/exist/xproc/examples/pidentity.xproc?stdin=/db/xproc/xml/test.xml&bindings=<bindings><binding
port="a"><test/></binding></bindings>

you should get

<test/>

hth, Jim Fuller

note - this is slightly non compliant behavior as you should also
declare the 'a' input port, will amend eventually

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: Problem with Admin page...

2009-11-26T21:14:23Z

Andzrej,

While the admin page works fine for me using the latest SVN build (rev
10655), I was able to reproduce your error using by commenting out the
module element declaring the XQDoc module in conf.xml. Therefore, it
sounds like you might've done your build without one or both of the
following:

1. conf.xml should declare the xqdoc module:

<module class="org.exist.xqdoc.xquery.XQDocModule"
uri="http://exist-db.org/xquery/xqdoc"/>
Are you using an older conf.xml that doesn't contain this element?

2. extensions/build.properties should contain the following lines:
#XQDoc extension
include.feature.xqdoc = true
Are you using an older local.build.properties that doesn't refer to
the XQDoc properties?

> error found while loading module fundocs: Error while loading module
> fundocs.xqm: error found while loading module xqdm: failed to load
> module 'http://exist-db.org/xquery/xqdoc' from
> 'http://exist-db.org/xquery/xqdoc. Source not found.
>
> Not sure why my local exist copy is trying to get a module from
> exist-db.org!!!

I agree that the error message could be more helpful. Perhaps it
should say instead, "Failed to load module
'http://exist-db.org/xquery/xqdoc', which was declared without
specifying a location; this module was not declared in conf.xml, so a
location for the module must be specified when importing the module."

Cheers,
Joe

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XProc: "No request object found in the current XQuery context." when using "request:get-parameter-names()"

2009-11-26T15:09:13Z

Thank you,

I have to confes my ignorance.

Would you be so kind to share an example regarding the effective use of bindings within a pipeline, namely how could I call the "parameters" passed.

Claudius Teodorescu

From forum: exist-open

ERROR: XMLDBException occurred while retrieving collection: HTTP server returned unexpected status: Invalid+password+specified+for+XQueryURLRewrite+user

2009-11-26T14:17:19Z

Hi,
I am getting this error when I try to log in using java admin client.
message:
XMLDBException occurred while retrieving collection: HTTP server returned unexpected status: Invalid+password+specified+for+XQueryURLRewrite+user
Exception stacktrace:
org.xmldb.api.base.XMLDBException: HTTP server returned unexpected status: Invalid+password+specified+for+XQueryURLRewrite+user
    at org.exist.xmldb.RemoteCollection.readCollection(RemoteCollection.java:388)
    at org.exist.xmldb.RemoteCollection.listChildCollections(RemoteCollection.java:291)
    at org.exist.client.InteractiveClient.getResources(InteractiveClient.java:326)
    at org.exist.client.InteractiveClient.run(InteractiveClient.java:2421)
    at org.exist.client.InteractiveClient.main(InteractiveClient.java:261)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at com.sun.javaws.Launcher.executeApplication(Unknown Source)
    at com.sun.javaws.Launcher.executeMainClass(Unknown Source)
    at com.sun.javaws.Launcher.doLaunchApp(Unknown Source)
    at com.sun.javaws.Launcher.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)
Caused by: org.apache.xmlrpc.client.XmlRpcHttpTransportException: HTTP server returned unexpected status: Invalid+password+specified+for+XQueryURLRewrite+user
    at org.apache.xmlrpc.client.XmlRpcSunHttpTransport.getInputStream(XmlRpcSunHttpTransport.java:94)
    at org.apache.xmlrpc.client.XmlRpcStreamTransport.sendRequest(XmlRpcStreamTransport.java:152)
    at org.apache.xmlrpc.client.XmlRpcHttpTransport.sendRequest(XmlRpcHttpTransport.java:115)
    at org.apache.xmlrpc.client.XmlRpcSunHttpTransport.sendRequest(XmlRpcSunHttpTransport.java:69)
    at org.apache.xmlrpc.client.XmlRpcClientWorker.execute(XmlRpcClientWorker.java:56)
    at org.apache.xmlrpc.client.XmlRpcClient.execute(XmlRpcClient.java:167)
    at org.apache.xmlrpc.client.XmlRpcClient.execute(XmlRpcClient.java:158)
    at org.apache.xmlrpc.client.XmlRpcClient.execute(XmlRpcClient.java:147)
    at org.exist.xmldb.RemoteCollection.readCollection(RemoteCollection.java:386)
    ... 13 more
Caused by: org.apache.xmlrpc.client.XmlRpcHttpTransportException: HTTP server returned unexpected status: Invalid+password+specified+for+XQueryURLRewrite+user
    at org.apache.xmlrpc.client.XmlRpcSunHttpTransport.getInputStream(XmlRpcSunHttpTransport.java:94)
    at org.apache.xmlrpc.client.XmlRpcStreamTransport.sendRequest(XmlRpcStreamTransport.java:152)
    at org.apache.xmlrpc.client.XmlRpcHttpTransport.sendRequest(XmlRpcHttpTransport.java:115)
    at org.apache.xmlrpc.client.XmlRpcSunHttpTransport.sendRequest(XmlRpcSunHttpTransport.java:69)
    at org.apache.xmlrpc.client.XmlRpcClientWorker.execute(XmlRpcClientWorker.java:56)
    at org.apache.xmlrpc.client.XmlRpcClient.execute(XmlRpcClient.java:167)
    at org.apache.xmlrpc.client.XmlRpcClient.execute(XmlRpcClient.java:158)
    at org.apache.xmlrpc.client.XmlRpcClient.execute(XmlRpcClient.java:147)
    at org.exist.xmldb.RemoteCollection.readCollection(RemoteCollection.java:386)
    at org.exist.xmldb.RemoteCollection.listChildCollections(RemoteCollection.java:291)
    at org.exist.client.InteractiveClient.getResources(InteractiveClient.java:326)
    at org.exist.client.InteractiveClient.run(InteractiveClient.java:2421)
    at org.exist.client.InteractiveClient.main(InteractiveClient.java:261)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at com.sun.javaws.Launcher.executeApplication(Unknown Source)
    at com.sun.javaws.Launcher.executeMainClass(Unknown Source)
    at com.sun.javaws.Launcher.doLaunchApp(Unknown Source)
    at com.sun.javaws.Launcher.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)

When I try to go to http://localhost:88/exist/admin/admin.xql . I get this:

HTTP ERROR: 500

Invalid password specified for XQueryURLRewrite user

RequestURI=/exist/admin/admin.xql

Powered by Jetty://

I can fix this by deleting all .dbx files but then I loose all my database data.

I am runing latest 1.4 version on windows server 2003.

Thank you for any help.

Vit

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: Issue while embedding exist db

2009-11-26T12:43:24Z

Hi,

On Thu, Nov 26, 2009 at 9:34 PM, Dannes Wessels <dizzzz@...> wrote:
>> ...and here is the java code (I know I've been playing around with the code
>> trying to get it to work, but the functionality is the same as in the
>> tutorial). I'll be very happy if someone can tell me what I'm doing wrong. I
>> thank you in advance!

don;t forget to create the data directories: mkdir -p webapp/WEB-INF/data

--
eXist-db Native XML Database - http://exist-db.org
Join us on linked-in: http://www.linkedin.com/groups?gid=35624

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: Issue while embedding exist db

2009-11-26T12:34:21Z

Hi,

On Thu, Nov 26, 2009 at 3:16 PM, Stephan Orbaugh Abalde
<stephan_orbaugh@...> wrote:
> ...and here is the java code (I know I've been playing around with the code
> trying to get it to work, but the functionality is the same as in the
> tutorial). I'll be very happy if someone can tell me what I'm doing wrong. I
> thank you in advance!

what is the purpose of the following line of code?

file = this.getClass().getClassLoader().getResource("conf.xml").toString();

this code clearly does not work the way you think it works. Remove the
line and just write

file = "conf.xml"

Probably you need to add the jar files in the endorsed directory on
your classpath as well.

regards

Dannes

--
eXist-db Native XML Database - http://exist-db.org
Join us on linked-in: http://www.linkedin.com/groups?gid=35624

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: cocoon troubles

2009-11-26T12:26:04Z

> Date: Thu, 26 Nov 2009 11:46:04 +0100
> From: Ron Van den Branden <ron.vandenbranden@...>
> Subject: Re: [Exist-open] cocoon troubles
>
>
> I think the logic is perfectly right, but you'll need this
> in your controller.xql match statement:
> matches($exist:path, "/jewelry")
> (or starts-with($exist:path, "/exist/jewelry"))
>
> ...as the path doesn't start with "/jewelry", but
> "/exist/jewelry".

Thanks, Ron! I'm sorry to have bothered you with my
misunderstanding of both the XPath "matches" function
and the value of "$exist:path". Thank you for untangling
my proverbial "six errors in the spelling of 'Noah'"!

I'm still seeing the same behavior (200 HTTP return code
but no content), but now I know at least the controller
config is correct.

-- tony

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XProc: "No request object found in the current XQuery context." when using "request:get-parameter-names()"

2009-11-26T12:18:49Z

> P,S, From where I can have the latest xprocxq.jar? I've looked into eXist
> SVN, but without succes.

you need to download eXist trunk from svn and build yourself (using ./build.sh)

Jim Fuller

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XProc: "No request object found in the current XQuery context." when using "request:get-parameter-names()"

2009-11-26T12:17:47Z

On Thu, Nov 26, 2009 at 8:24 PM, claud108 <claud108@...> wrote:
>
> Thank you for your answer.
>
>
> In http://localhost:8080/exist/xproc/xproc.xml is written that the URL param
> is "binding" while you mention above "bindings". Which one is it? But, for
> me, none works.

http://127.0.0.1:8080/exist/xproc/examples/hello.xproc?stdin=/db/xproc/xml/test-ns.xml&bindings=<bindings><binding
port="a"><test/></binding></bindings>

is an example url, note how you pass in the 'a' input port

I will amend docs, going offline now

J

>
> I will keep testing.
>
> Claudius Teodorescu
>
> P,S, From where I can have the latest xprocxq.jar? I've looked into eXist
> SVN, but without succes.
> --
> View this message in context: http://old.nabble.com/XProc%3A-%22No-request-object-found-in-the-current-XQuery-context.%22-when-using-%22request%3Aget-parameter-names%28%29%22-tp25921906p26533936.html
> Sent from the exist-open mailing list archive at Nabble.com.
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Exist-open mailing list
> Exist-open@...
> https://lists.sourceforge.net/lists/listinfo/exist-open
>

From forum: exist-open

Re: XProc: "No request object found in the current XQuery context." when using "request:get-parameter-names()"

2009-11-26T11:24:32Z

Thank you for your answer.

In http://localhost:8080/exist/xproc/xproc.xml is written that the URL param is "binding" while you mention above "bindings". Which one is it? But, for me, none works.

I will keep testing.

Claudius Teodorescu

P,S, From where I can have the latest xprocxq.jar? I've looked into eXist SVN, but without succes.

From forum: exist-open

Re: XRX applications and SQL injection type attacks

2009-11-26T09:51:09Z

My mistake.

On Nov 26, 2009, at 11:40 AM, Wolfgang Meier wrote:

>> Currently XACML only works against the RESTful calls to function modules in XQuery.
>
> No, I don't think this is correct. Even now, XACML policies are
> applied to any invocation of an XQuery within eXist.
>
> Wolfgang

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XRX applications and SQL injection type attacks

2009-11-26T09:40:53Z

> Currently XACML only works against the RESTful calls to function modules in XQuery.

No, I don't think this is correct. Even now, XACML policies are
applied to any invocation of an XQuery within eXist.

Wolfgang

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XRX applications and SQL injection type attacks

2009-11-26T09:28:42Z

I think we agree that all of those issues can be handled somehow. In
particular, you can use XACML to restrict access to certain functions
or modules, even if they are called via util:eval or util:function. It
is a pitty that nobody uses the XACML module (me included). Ok, I know
it's not very well documented and difficult to configure, but this can
be changed. Well, I welcome Loren's initiative to revive the XACML
support. It's a core building block with respect to security.

>> 1) higher-order function stuff i.e. util:function() and util:call()
>> 2) Java native function binding (disabled by default in conf.xml)

If you enable native function binding, XACML should be a must.

>> 3) XSLT injection - transform:transform()

right now, XSLTs have no direct access to the db so they can't do much
harm. This will change with the native XSLT support (though we could
also use XACML then).

>> 4) Scheduler injection via the scheduler module

A scheduled function can not do more harm than any other XQuery function.

>> 5) Behaviour injection via collection.xconf - i.e. adding triggers etc.

One advantage of keeping the collection configuration separate from
the target collections is that you can restrict access to it.

Wolfgang

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XRX applications and SQL injection type attacks

2009-11-26T09:08:14Z

> Well it depends on how you collect the parameters to those functions,
> all of this is just as dangerous as util:eval IMHO

I think that difficult or ever impossible to collect parameters for
run them as XQUERY/XSLT/XPROC.
This is equal a sandbox worked with admin access :)

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XRX applications and SQL injection type attacks

2009-11-26T09:05:37Z

to the original poster;

In production I never expose eXist directly to the internet and always
opt to wrap it up using either modperl (plus something like
modsecurity) or something else and just allow localhost access.

This certainly doesn't solve security problems (such as injection) but
does cut out a lot of issues.

sanitizing input is the first step; reminds me it maybe useful to
generate a few examples of how things can be subverted in eXist ...
which I will probably add to test suite soon.

Jim Fuller

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XRX applications and SQL injection type attacks

2009-11-26T09:03:39Z

> If this is what you are using util:eval for, then you should not be
> sing util:eval, but rather use util:call and util:function

I'm agree, but we can not use util:function()/util:call() method
if we don't know qname of called function in script or module
(util:function() require static context of query).
Also optimisation and indexes is not worked in function,
when we call one via util:function().

Son on just moment util:eval() is best case.

P.S. Optimisaton and indexes are not working also
under "case" clause of "typeswitch" expression.

-------
Evgeny

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XRX applications and SQL injection type attacks

2009-11-26T08:57:16Z

2009/11/26 Evgeny Gazdovsky <gazdovsky@...>:
> 1) higher-order function stuff i.e. util:function() and util:call()
> 2) Java native function binding (disabled by default in conf.xml)
> 3) XSLT injection - transform:transform()
> 4) Scheduler injection via the scheduler module
> 5) Behaviour injection via collection.xconf - i.e. adding triggers etc.
>
> All this injection is inner - this equal if attacker have access into db

Well it depends on how you collect the parameters to those functions,
all of this is just as dangerous as util:eval IMHO

> Outer XQuery injection possible via util:eval()
> But I think that always possible to use "right" method of util:eval() like:
>
> let $x:=local:some-expression-for-param(), $func:="local:some-called-function"
> return util:eval(concat($func,"($x)", true())
>
> In this case omposible to change called script, but possible
> dinamicaly call functions whith param.

If this is what you are using util:eval for, then you should not be
using util:eval, but rather use util:call and util:function

> -----------
> Evgeny
>

--
Adam Retter

eXist Developer
{ United Kingdom }
adam@...
irc://irc.freenode.net/existdb

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XRX applications and SQL injection type attacks

2009-11-26T08:47:48Z

---------- Forwarded message ----------
From: Evgeny Gazdovsky <gazdovsky@...>
Date: 2009/11/26
Subject: Re: [Exist-open] XRX applications and SQL injection type attacks
To: Adam Retter <adam@...>

1) higher-order function stuff i.e. util:function() and util:call()
2) Java native function binding (disabled by default in conf.xml)
3) XSLT injection - transform:transform()
4) Scheduler injection via the scheduler module
5) Behaviour injection via collection.xconf - i.e. adding triggers etc.

All this injection is inner - this equal if attacker have access into db

Outer XQuery injection possible via util:eval()
But I think that always possible to use "right" method of util:eval() like:

let $x:=local:some-expression-for-param(), $func:="local:some-called-function"
return util:eval(concat($func,"($x)", true())

In this case omposible to change called script, but possible
dinamicaly call functions whith param.

-----------
Evgeny

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Problem with Admin page...

2009-11-26T08:43:13Z

With the latest SVN build, when I try to hit the admin page I get the
following exception:

error found while loading module fundocs: Error while loading module
fundocs.xqm: error found while loading module xqdm: failed to load
module 'http://exist-db.org/xquery/xqdoc' from
'http://exist-db.org/xquery/xqdoc. Source not found.

Not sure why my local exist copy is trying to get a module from
exist-db.org!!!

Thanks!

....Andrzej

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XRX applications and SQL injection type attacks

2009-11-26T08:09:20Z

2009/11/26 Kurt Cagle <kurt.cagle@...>:
> It's worth noting that XQuery injection attacks are certainly possible,
> though primarily due to stupidity on the part of developers working within
> web environments making use of util:eval() or similar mechanisms for
> execution without due thought about security, or letting people arbitrarily
> write XQuery code as messages. Of course this is the same case as with SQL
> injection attacks - it's not usually poor design on the part of the language
> or environment developer so much as poor design on the part of the
> application developer.

Agreed, XQuery injection attacks are indeed possible. Other points of
consideration are -

1) higher-order function stuff i.e. util:function() and util:call()
2) Java native function binding (disabled by default in conf.xml)
3) XSLT injection - transform:transform()
4) Scheduler injection via the scheduler module
5) Behaviour injection via collection.xconf - i.e. adding triggers etc.

> Having said that I think that the design of XQuery is such that such attacks
> would be harder to write if you did have an intelligent design context at
> work in your application than would be the case for SQL.
>
> Kurt Cagle
> Managing Editor
> http://xmlToday.org
>
>
> On Wed, Nov 25, 2009 at 5:56 PM, Loren Cahlander <loren.cahlander@...>
> wrote:
>>
>> We are in the process of enhancing the security of eXist. The
>> authentication part of security is going to be modularized to allow the
>> addition of new authentication technology to eXist. The OpenID technology
>> will be added to the base of eXist.
>>
>> For access control, there is UNIX style security and the optional XACML.
>> We are in the process of redoing the XACML implementation. Currently XACML
>> only works against the RESTful calls to function modules in XQuery. There
>> will be RESTful administrative tools to make the management of the XACML
>> documents easy to do by hiding the complexity of the XACML documents and
>> will be geared explicitly to eXist.
>>
>> The XACML implementation will be using a Role-Based Access Control model.
>> This allows for people changing roles without having to change access to
>> each individual collection, document and function within eXist.
>>
>>
>>
>> On Nov 24, 2009, at 02:03 PM, Derek Werthmuller wrote:
>>
>> > Given that SQL injection type attacks are in the top ten web application
>> > security issues this year again. Pick your list SANS
>> > http://www.sans.org/top-cyber-security-risks/, OWASP
>> > http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project.
>> >
>> > Are we going to be better off (provide more secure applications)with XML
>> > powered applications? Or are we at least building the foundation for
>> > more
>> > secure applications?
>> >
>> > It would seem to me the answer is yes, provided that schemas are used to
>> > validate data, before its operated on, and stored. And that data
>> > manipulation in applications will be less complex.
>> > Or are the issues going to get more complex, since everything will look
>> > more
>> > or less the same (XML, xpath, xqueries, etc).
>> >
>> > Have any studies or comparisons been done with XRX type applications and
>> > legacy relational database powered?
>> >
>> > Thanks
>> > Derek
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Let Crystal Reports handle the reporting - Free Crystal Reports 2008
>> 30-Day
>> trial. Simplify your report design, integration and deployment - and focus
>> on
>> what you do best, core application coding. Discover what's new with
>> Crystal Reports now. http://p.sf.net/sfu/bobj-july
>> _______________________________________________
>> Exist-open mailing list
>> Exist-open@...
>> https://lists.sourceforge.net/lists/listinfo/exist-open
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus
> on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Exist-open mailing list
> Exist-open@...
> https://lists.sourceforge.net/lists/listinfo/exist-open
>
>

--
Adam Retter

eXist Developer
{ United Kingdom }
adam@...
irc://irc.freenode.net/existdb

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Exist-open mailing list
Exist-open@...
https://lists.sourceforge.net/lists/listinfo/exist-open

From forum: exist-open

Re: XRX applications and SQL injection type attacks

2009-11-26T07:45:00Z

Jim,

Yeah, that did come out wrong. By stupidity, what I'm talking about here is using, through ignorance or apathy, bad or potentially dangerous design patterns when creating applications. Of course, as we're still very much in the best practices development stage of XQuery, we're all very much likely to be stupid now and again - a lot of best practices emerge after we've discovered the consequences of using less than best practices in our work.

Kurt Cagle
Managing Editor
http://xmlToday.org

On Thu, Nov 26, 2009 at 12:53 AM, James Fuller <james.fuller.2007@...> wrote:

On Thu, Nov 26, 2009 at 4:56 AM, Kurt Cagle <kurt.cagle@...> wrote:
> It's worth noting that XQuery injection attacks are certainly possible,
> though primarily due to stupidity on the part of developers working within

I think its a little harsh to call this stupidity, odds are if you are
programming today that you will generate several errors whist doing so
... its a side effect of being human; the *only* way to counteract
this natural trend for producing defects is to use other techniques to
improve the quality of your code (unit testing, peer review, etc).

and even then, one can still make bad design decisions, etc ...

will try and respond to the original posters question sometime later.

Jim Fuller

From forum: exist-open