RE: XML Questions

["Jay Freeman \(saurik\)" <saurik () saurik com>]

If you look at many of the XML web architectures, they are moving towards
SAX.  Cocoon is one of these.  And it would be useful to stream from nmap to
a web page and off to the client before getting all of the data.  With
chunked transfer encoding HTTP is perfectly fine with that, and so are most
of the web engines.

You definitely DO need a root tag on an XML file.  I'd work on getting the
XML structure right first :) (but that was already gone over by Stou in his
post).  One thing I would consider is moving some of the parts together more
into a few larger tags.  This shouldn't make much of a difference in most
cases, but there are definitely some parsers that would be greatly helped by
it:

In the example there was (fixed for XML correctness):

<host status="up">
<address addr="192.168.0.24" addrtype="ipv4"/>
<address addr="00:C0:F0:48:3A:54" addrtype="mac"/>
<hostname name="amy.insecure.org" type="A"/>
...

When you go to stream that document and ask your XML parser expect multiple
"address" tags, possibly doing an XSLT step, the processing can't continue
until the entire <host/> has been buffered into memory and you can make sure
that somewhere at the very end of the tag someone wasn't hiding an extra
<address/>.  If you combined those under a single tag, you could either
request only the first instance (or have in the DTD that there will only be
one, so the parser can know this while working on the document) of the
larger tag, and then parse through just that piece before moving on.  I
can't remember if DTD lets you (or forces you) specify the order of tags, so
you would know all the address tags come in front of all the hostname tags,
etc., but there will definitely be a large number of people parsing this
stuff in a non-validating parser anyway, so the DTD isn't going to be able
to help those situations.  I am going to try to figure out whether DTD
force/allow tag order, spent about 10 minutes looking and haven't come up
with anything yet, will likely find something tomorrow (I know it was in my
little XML reference book...).  For now, I would suggest this instead:

<host status="up">
  <addresses>
    <address addr="192.168.0.24" addrtype="ipv4"/>
    <address addr="00:C0:F0:48:3A:54" addrtype="mac"/>
  </addresses>
  <hostnames>
    <hostname name="amy.insecure.org" type="A"/>
...

The client can then be waiting for the first <addresses/> brick, read all
the addresses from it, and when it is done with the addresses continue on to
something else... the same goes for <hostnames/>.  In general clumping
things is more likely to help you down the road than harm you, and it
definitely won't decrease the stream-ability of the document, if anything it
should greatly increase it (assuming you clump the right things, of course).

Sincerely,
Jay Freeman (saurik)
saurik () saurik com


---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List run by ezmlm-idx (www.ezmlm.org).