- BaseX-Talk - mailman.uni-konstanz.de

child node problem
by Giuseppe Celano 04 Apr '18

04 Apr '18

Hi All, Thanks for this new release, which looks great! I have found a problem though (see error message below), when running a query like: for $ee in collection("my-path-to-files") where $ee//case[./aspect-values[@sign = "yes"]] return $ee This works in version 8.6.7. The problem seems to be [./aspect-values[@sign = "yes"]]: if I change it in [//aspect-values[@sign = "yes"]] it works fine also in 9.0. Any idea? Thanks. Best, Giuseppe ERROR MESSAGE Error: Improper use? Potential bug? Your feedback is welcome: Contact: basex-talk(a)mailman.uni-konstanz.de Version: BaseX 9.0 Java: Oracle Corporation, 1.8.0_151 OS: Mac OS X, x86_64 Stack Trace: java.lang.ClassCastException: org.basex.query.value.item.Dummy cannot be cast to org.basex.query.value.node.DBNode at org.basex.query.expr.path.InvDocTest.get(InvDocTest.java:56) at org.basex.query.expr.path.Path.index(Path.java:692) at org.basex.query.expr.path.Path.optimize(Path.java:174) at org.basex.query.expr.path.Path.optimize(Path.java:180) at org.basex.query.expr.path.Path.compile(Path.java:157) at org.basex.query.expr.gflwor.Where.compile(Where.java:53) at org.basex.query.expr.gflwor.Where.compile(Where.java:1) at org.basex.query.expr.gflwor.GFLWOR.compile(GFLWOR.java:101) at org.basex.query.scope.MainModule.comp(MainModule.java:83) at org.basex.query.QueryCompiler.compile(QueryCompiler.java:114) at org.basex.query.QueryCompiler.compile(QueryCompiler.java:105) at org.basex.query.QueryContext.compile(QueryContext.java:299) at org.basex.query.QueryProcessor.compile(QueryProcessor.java:79) at org.basex.core.cmd.AQuery.query(AQuery.java:78) at org.basex.core.cmd.XQuery.run(XQuery.java:22) at org.basex.core.Command.run(Command.java:257) at org.basex.core.Command.execute(Command.java:93) at org.basex.gui.GUI.exec(GUI.java:427) at org.basex.gui.GUI.lambda$4(GUI.java:370) at java.lang.Thread.run(Thread.java:748) Compiling: - pre-evaluate fn:collection([uri]) to document-node() sequence: collection("/Users/mycomputer/Documents/... -> (db:open-pre("documents", 0), ...) - rewrite cached path to = operator: *:aspect-values -> (*:aspect-values/@*:sign = "yes") - rewrite cached path to = operator: *:aspect-values -> (*:aspect-values/@*:sign = "yes") - rewrite descendant-or-self step(s) - apply attribute index for "yes" Optimized Query: for $ee_0 in (db:open-pre("documents", 0), ...) where $ee_0/descendant-or-self::node()/descendant::*:case[(*:aspect-values/@*:sign = "yes")] return $ee_0 Query: for $ee in collection("/Users/mycomputer/Documents/act/03_p-valuesAfterReductionToPerfImp/documents") where $ee//case[./aspect-values[@sign = "yes"]] return $ee Universität Leipzig Institute of Computer Science, Digital Humanities Augustusplatz 10 04109 Leipzig Deutschland E-mail: celano(a)informatik.uni-leipzig.de E-mail: giuseppegacelano(a)gmail.com Web site 1: http://www.dh.uni-leipzig.de/wo/team/ Web site 2: https://sites.google.com/site/giuseppegacelano/

2 2

Is the support for "Events" is stopped in the recent versions?
by Nivas 03 Apr '18

03 Apr '18

Hi All, Is the support for "Events" is stopped in the recent versions of BaseX database? I would like to have a notification mechanism i.e. whenever a particular element changes(specified by xpath), I want an event to be triggered. Is that possible? I would be using basex python client. Thanks in advance. Kind regards, Seeni

2 2

basex install on linux server
by Friedrich Frei 01 Apr '18

01 Apr '18

Sehr geehrte Damen und Herren! Ich möchte mit Ihrem Produkt Webseiten entwickeln, habe aber nie Java benutzt. Wenn Sie eine Anweisung haben, auf deren Grundlage ich die Datenbank installieren könnte. Wenn Sie mir Schritt für Schritt zeigen können, bin ich Ihnen sehr dankbar . Ich benutze Ubuntu Apache2 PHP. Mit freundlichen Grüßen -- Friedrich Frei

1 0

Maven repo 9.0
by Marc van Grootel 31 Mar '18

31 Mar '18

Hi, First of all congrats with the release of the Spring edition. Nice steady pace of quality updates. I wanted to test 9.0 by getting it via de Maven coordinates but noticed that 9.0 wasn't available from the basex Maven repo. Only 9.0-SNAPSHOT and 9.0.1-SNAPSHOT. Is it possible to also make 9.0 available from org.basex:basex-api:9.0 Maven coordinates? --Marc

3 4

Q: Is there a way to update a XML node with subelements
by Harald Freudenberger 30 Mar '18

30 Mar '18

Hello BaseX team I am about to implement a simple web application which displays some items and allows an user to edit one item. So my database is simple: data.xml: <items> <item> <id>1</id> <text>just some text</text> </item> <item> <id>2</id> <text>some other text</text> </item> </items> Now I want to add a new item to this database. For first evaluation I'll use curl to insert a new node with: curl -u admin:admin -i -X PUT -H "Content-Type: application/xml" -d "<item><id>9999</id><text>hello</text></item>" "http://localhost:8984/rest/data/items" The query to check if the new node has been inserted gives: curl -u admin:admin -i -X POST -H "Content-Type: application/xml" -d "<query xmlns='http://basex.org/rest'><text>//item</text></query>" "http://localhost:8984/rest/data" HTTP/1.1 200 OK Content-Type: application/xml; charset=UTF-8 Content-Length: 1416 Server: Jetty(8.1.18.v20150929) <item> <id>1</id> <text>just some text</text> </item> <item> <id>2</id> <text>some other text</text> </item> <item> <id>9999</id> <text>hello</text> </item> Fine. And now I'd like to try the edit an item. I start with fetching the item: curl -u admin:admin -i -X POST -H "Content-Type: application/xml" -d "<query xmlns='http://basex.org/rest'><text>//item[id='9999']</text></query>" "http://10.0.2.2:8984/rest/data" HTTP/1.1 200 OK Content-Type: application/xml; charset=UTF-8 Content-Length: 280 Server: Jetty(8.1.18.v20150929) <item> <id>9999</id> <text>hello</text> </item> Now I do some modifications: <item> <id>9999</id> <text>new text here</text> <newnode>a new node</newnode> </item> And then I want to write back this item with: curl -u admin:admin -i -X POST -H "Content-Type: application/xml" -d "<query xmlns='http://basex.org/rest'><text>replace node /data/items/item[id='9999'] with <item><id>8888</id></item></text></query>" "http://10.0.2.2:8984/rest/crypto" HTTP/1.1 400 Bad Request Content-Type: text/plain;charset=UTF-8 Content-Length: 104 Server: Jetty(8.1.18.v20150929) cvc-type.3.1.2: Element 'text' is a simple type, so it must have no element information item [children]. I tried <command> instead of <query> but the result is always the same. Am I doing something wrong here ? Is there a way to update a node with subelements in BaseX ? Please understand, I am C developer dealing with Linux kernel code most of the time so I am not really familiar with all the web application things. Thanks and regards Harald Freudenberger

2 1

Re: [basex-talk] SSL support for BaseX REST API
by Lizzi, Vincent 22 Mar '18

22 Mar '18

Forwarding to the list... ________________________________ From: Stefania Axo <stefy(a)us.ibm.com> Sent: Wednesday, March 21, 2018 10:05 PM To: Lizzi, Vincent Subject: Re: [basex-talk] SSL support for BaseX REST API ok i was able to set the property of not starting BaseXServer on both Jetty and WebSphere liberty in WEB-INF\web.xml <context-param> <param-name>org.basex.httplocal</param-name> <param-value>true</param-value> </context-param> on the documentation http://docs.basex.org/wiki/Options#HTTPLOCAL<http://docs.basex.org/wiki/Options#HTTPLOCAL> it says "If the option is set to false, the database server will be disabled. " is it the other way around? "If the option is set to true, the database server will be disabled. " thanks Stefania

1 0

SSL support for BaseX REST API
by Giavanna J Richards 22 Mar '18

22 Mar '18

I'm trying to determine how to enable SSL communications with the BaseX server, I have a java server which communicates with BaseX over its REST API for running xquery's. I see in the BaseX changelog that SSL support was added to version 7.5 in 2012 but I haven't been able to find any references to it in the documentation. I found some statements in the jetty.xml file which are commented out and would appear to enable SSL on port 8986. But I'm not at all familiar with jetty. Is there some documentation available for enabling this support? Thanks in advance! Giavanna Richards

5 7

Uncomprehensible (at least to me) behaviour with external bindings
by Marco Lettere 21 Mar '18

21 Mar '18

Hi all, trying to understand why we get the exception [2] running the code [1] in a Java app, I stumbled upon a strange behaviour of the GUI. I rewrote the query to: xquery:eval(" declare variable $_dep as xs:long* external; $_dep[2] * $_dep[2]", map{ "_dep" : (1,2,3)}) obtaining the correct result (4). Anyway if I assign (1,2,3) to a binding through the proper dialog of the UI I get the following exception at execution: Error: Stopped at /home/lettere/git/dasbox-frontend/dasbox-frontend-ui/webapp/ui/resources/js/monitoring/file, 2/12: [FORG0001] Cannot cast to xs:double: (1,2,3). Strangely enough this happens even if I leave the map overriding locally the values for the external parameters in the xquery:eval. The dialog wins? If I rewrite the query like this and remove the parameter values from the dialog: xquery:eval(" declare variable $_dep as xs:long* external := (1,2,3); $_dep[2] * $_dep[2]") I get yet another typecast exception: Error: Stopped at /home/lettere/git/dasbox-frontend/dasbox-frontend-ui/webapp/ui/resources/js/monitoring/file, 2/12: [XPTY0004] Cannot promote xs:integer+ to $_dep as xs:long*: (1, 2, 3). Is there a nice wording to explain all this different behaviour and might it be that the exception we get in the Java embedded version is somehow related to the same? Thanks a lot for helping, Marco. [1] declare variable $_history as xs:long* external; declare variable $_now as xs:dateTime external; declare variable $_dep as xs:long* external; declare variable $dep as xs:long external; $_dep[2] * $_dep[2] [2] Caused by: org.basex.query.QueryException: [FORG0001] Cannot cast to xs:double: [Ljava.lang.Object;@2f0539f0. at org.basex.query.QueryError.get(QueryError.java:1365) ~[BaseX.jar:8.6.7] at org.basex.query.QueryError.castError(QueryError.java:1571) ~[BaseX.jar:8.6.7] at org.basex.query.value.item.Dbl.parse(Dbl.java:180) ~[BaseX.jar:8.6.7] at org.basex.query.value.item.Item.dbl(Item.java:134) ~[BaseX.jar:8.6.7] at org.basex.query.value.type.AtomType.checkLong(AtomType.java:927) ~[BaseX.jar:8.6.7] at org.basex.query.value.type.AtomType$20.cast(AtomType.java:331) ~[BaseX.jar:8.6.7] at org.basex.query.value.type.AtomType$20.cast(AtomType.java:1) ~[BaseX.jar:8.6.7] at org.basex.query.QueryContext.cast(QueryContext.java:733) ~[BaseX.jar:8.6.7] at org.basex.query.QueryContext.bind(QueryContext.java:486) ~[BaseX.jar:8.6.7] at org.basex.query.QueryProcessor.bind(QueryProcessor.java:129) ~[BaseX.jar:8.6.7] at com.nw.basex.xquery.XQueryExecutor.bind(XQueryExecutor.java:89) ~[com.nw.dasbox-2018-03-15.jar:?] at com.nw.basex.xquery.XQueryExecutor.execute(XQueryExecutor.java:107) ~[com.nw.dasbox-2018-03-15.jar:?] at com.nw.dasbox.vdr.resolution.InlineXQueryResolutionEngine.evaluate(InlineXQueryResolutionEngine.java:91) ~[com.nw.dasbox-2018-03-15.jar:?] ... 10 more

2 2

Re: [basex-talk] TR: Marklogic XXE and XML Bomb prevention
by Bridger Dyson-Smith 14 Mar '18

14 Mar '18

Forwarding/replying to the list, since I'm officially Bad At Email. On Wed, Mar 14, 2018 at 11:56 AM, Bridger Dyson-Smith <bdysonsmith(a)gmail.com > wrote: > Hi Fabrice - > > On Wed, Mar 14, 2018 at 11:28 AM, Fabrice ETANCHAUD < > fetanchaud(a)pch.cerfrance.fr> wrote: > >> Hello, >> >> >> >> I found this MarkLogic post interesting, >> >> So I forward it to the BaseX users. >> >> I do not remember loading data I did not trust, but did somebody >> experience this kind of issue ? >> >> > I certainly haven't :) but clearly Christian, et al, have considered > something similar to this. The INTPARSE[1] option let's you use an internal > parser, instead of the standard Java parser. There are options in the > BaseX GUI to use the INTPARSE *and* expand entities from DTDs, but I don't > know if those switches are available in the Options. > >> >> >> Best regards, >> >> Fabrice Etanchaud >> >> >> > > Hope that sheds some light on this. I tried the MarkLogic example using > the INTPARSE (and no DTDs/entity parsing) and created a database that > contains `<foo/>` :). > > And on an additional test, again using the BaseX GUI, using the default Java Parser (both with and without the 'Parse DTDs and entities' option selected), databases were created that expanded the entity and inserted <foo> <thing> <one>ONE</one> </thing> </foo> into the db. > Best, > Bridger > > [1] http://docs.basex.org/wiki/Options#INTPARSE > > So... untrusted input? INTPARSE is your friend - unless you need to expand custom entities. Bridger > > >> *De :* general-bounces(a)developer.marklogic.com [mailto: >> general-bounces(a)developer.marklogic.com] *De la part de* Marcel de Kleine >> *Envoyé :* mercredi 14 mars 2018 13:43 >> *À :* general(a)developer.marklogic.com >> *Objet :* [MarkLogic Dev General] Marklogic XXE and XML Bomb prevention >> >> >> >> Hello, >> >> >> >> We have noticed Marklogic is vulnerable to xxe (entity expansion) and xml >> bomb attacks. When loading an malicious document using xdmp:document-insert >> it won’t catch these and cause either loading of unwanted external >> documents (xxe) and lockup of the system (xml bomb). >> >> >> >> For example, if I load this document : >> >> <?xml version="1.0" encoding="ISO-8859-1"?> >> >> <!DOCTYPE foo [ >> >> <!ELEMENT foo ANY > >> >> <!ENTITY xxe SYSTEM "file:///c:/text.xml" >]> >> >> <foo>&xxe;</foo> >> >> >> >> The file test.xml gets nicely added to the xml document. >> >> >> >> See OWASP and others for examples. >> >> >> >> This is clearly a xml processing issue so the question is : can we >> disable this? And if so, on what levels would this be possible. Best should >> be system-wide. >> >> ( And if you cannot disable this, I think this is something ML should >> address immediately. >> >> >> >> Thank you in advance, >> >> Marcel de Kleine, EPAM >> >> >> >> *Marcel de Kleine* >> >> *Senior Software Engineer* >> >> >> >> *Office: *+31 20 241 6134 *x* 30530 <+31%2020%20241%206134;ext=30530> >> *Cell: *+31 6 14806016 <+31%206%2014806016> *Email: * >> marcel_de_kleine(a)epam.com >> >> *Delft,* *Netherlands * *epam.com <http://www.epam.com>* >> >> >> >> CONFIDENTIALITY CAUTION AND DISCLAIMER >> This message is intended only for the use of the individual(s) or >> entity(ies) to which it is addressed and contains information that is >> legally privileged and confidential. If you are not the intended recipient, >> or the person responsible for delivering the message to the intended >> recipient, you are hereby notified that any dissemination, distribution or >> copying of this communication is strictly prohibited. All unintended >> recipients are obliged to delete this message and destroy any printed >> copies. >> >> >> > >

2 1

TR: Marklogic XXE and XML Bomb prevention
by Fabrice ETANCHAUD 14 Mar '18

14 Mar '18

Hello, I found this MarkLogic post interesting, So I forward it to the BaseX users. I do not remember loading data I did not trust, but did somebody experience this kind of issue ? Best regards, Fabrice Etanchaud De : general-bounces(a)developer.marklogic.com [mailto:general-bounces@developer.marklogic.com] De la part de Marcel de Kleine Envoyé : mercredi 14 mars 2018 13:43 À : general(a)developer.marklogic.com Objet : [MarkLogic Dev General] Marklogic XXE and XML Bomb prevention Hello, We have noticed Marklogic is vulnerable to xxe (entity expansion) and xml bomb attacks. When loading an malicious document using xdmp:document-insert it won't catch these and cause either loading of unwanted external documents (xxe) and lockup of the system (xml bomb). For example, if I load this document : <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///c:/text.xml<file:///c:\text.xml>" >]> <foo>&xxe;</foo> The file test.xml gets nicely added to the xml document. See OWASP and others for examples. This is clearly a xml processing issue so the question is : can we disable this? And if so, on what levels would this be possible. Best should be system-wide. ( And if you cannot disable this, I think this is something ML should address immediately. Thank you in advance, Marcel de Kleine, EPAM Marcel de Kleine Senior Software Engineer Office: +31 20 241 6134 x 30530<tel:+31%2020%20241%206134;ext=30530> Cell: +31 6 14806016<tel:+31%206%2014806016> Email: marcel_de_kleine(a)epam.com<mailto:marcel_de_kleine@epam.com> Delft, Netherlands epam.com<http://www.epam.com> CONFIDENTIALITY CAUTION AND DISCLAIMER This message is intended only for the use of the individual(s) or entity(ies) to which it is addressed and contains information that is legally privileged and confidential. If you are not the intended recipient, or the person responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. All unintended recipients are obliged to delete this message and destroy any printed copies.

2 1