[prev in list] [next in list] [prev in thread] [next in thread] 

List:       xml-security-dev
Subject:    Re: XPath
From:       Christian Geuer-Pollmann <geuer-pollmann () nue ! et-inf ! uni-siegen ! de>
Date:       2001-10-10 9:24:11
[Download RAW message or body]

Hi Peter

--On Mittwoch, 10. Oktober 2001 10:58 +0200 Peter Tornberg 
<tberg@x-obi.com> wrote:

> I have things working now, but one thought struck me that I think was
> odd.
> Using the XPath:
>
> 1) ancestor-or-self::node() =
> here()/ancestor::ds:Signature[1]/ds:Object[1]
> makes sense to identify the ds:Object with all children. However the
> following XPath shouldn't be true for all nodes in the doc, or should it?
>
> 2) here()/../../../../../ds:Object[1]
>
> All nodes in the doc do not have the ds:Object 5 levels up. When I run
> this I still get the entire doc as a result. I understand that the
> following XPath is true for all nodes.

Hm, in my first explanation of this I made a mistake: A colleague reminded 
me about it:

here() identifies the ds:XPath element, not the Text node in which the 
here() occurerd but the surrounding Element. which I stated in the last mail

here() is the ds:XPath
here()/.. is the ds:Transform
here()/../.. is the ds:Transforms
here()/../../.. is the ds:Reference
here()/../../../.. is the ds:SignedInfo
here()/../../../../.. is the ds:Signature
here()/../../../../../ds:Object[1] is the first Object

> All nodes in the doc do not have the ds:Object 5 levels up. When I run
> this I still get the entire doc as a result. I understand that the
> following XPath is true for all nodes.
>
> 2) here()/../../../../../ds:Object[1]
> 3) here()/ancestor::ds:Signature[1]/ds:Object[1]
>
> Shouldn't 2 and 3 return different sets of nodes?

No, from what I see they both identify the same ds:Object Element


So to use this,

<ds:XPath>
ancestor-or-self::node() =
here()/ancestor::ds:Signature[1]/ds:Object[1]
</ds:XPath>

<ds:XPath>
ancestor-or-self::node() =
here()/../../../../../ds:Object[1]
</ds:XPath>

should both do their job...


<ds:XPath>
here()/ancestor::ds:Signature[1]/ds:Object[1]
</ds:XPath>

<ds:XPath>
here()/../../../../../ds:Object[1]
</ds:XPath>

both identify the complete document because the evaluate (according to XML 
Signature) both to true for all nodes, so they select every node. (I think 
so ;-) But for more on this topic, I also asked the Signature WG [1]

Christian

[1] 
http://lists.w3.org/Archives/Public/w3c-ietf-xmldsig/2001OctDec/0010.html

[prev in list] [next in list] [prev in thread] [next in thread]