[x3d-public] JSON schema handling of Script url containing ecmascript source

Sun Aug 20 16:09:19 PDT 2017

Here’s how I modify format uri in Ajv.  I don’t know if it will pass code though. I also wonder if this is usable in Java, but you can try. I don’t even know if this will get through email, but you can see it here: https://github.com/coderextreme/X3DJSONLD/blob/master/src/main/node/loaderJQuery.js .  If someone puts code in a @url in X3DJSONLD (the loader part), I believe I will throw up a warning, and they can investigate and accept.  The @url field gets passed to X3DOM and Cobweb, possibly modified (oops!).  What happens if you put a second piece of ecmascript in the url (in XML)?  How is behavior defined in the standard?  

This regexp is what caught uses of ## in @url.

                ajv.addFormat("uri", /^(?:[a-z][a-z0-9+\-.]*:)?(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)?(?:\?(?:[a-z0-9\-._~!$&'()*+,;=:@\/?]|%[0-9a-f]{2})*)?(?:\#(?:[a-z0-9\-._~!$&'()*+,;=:@\/?]|%[0-9a-f]{2})*)?$/i);

Sent from Mail for Windows 10

From: John Carlson
Sent: Sunday, August 20, 2017 5:53 PM
To: Don Brutzman; Roy Walmsley
Cc: X3D Graphics public mailing list
Subject: RE: JSON schema handling of Script url containing ecmascript source

Code does not match a URI.  You can modify your validator to accept a wider range of URI values, or we can get rid of the format, or we can probably all decide on a different format. Choices 1 and 3 require you modify your validator. 

Here’s the current definition of @url in JSON schema:
                                "@url": {
                                        "type": "array",
                                        "minItems": 1,
                                        "items": {
                                                "type": "string",
                                                "format": "uri"
                                        }
                                }

Sent from Mail for Windows 10

From: Don Brutzman
Sent: Sunday, August 20, 2017 5:31 PM
To: Roy Walmsley; John Carlson
Cc: X3D Graphics public mailing list
Subject: JSON schema handling of Script url containing ecmascript source

Found the following problem with JSON schema handling of Script url containing 
source:

====================================

C:\x3d-code\www.web3d.org\x3d\content\examples\Vrml2Sourcebook/Chapter30Scripts//Figure30_1ScriptSlidingBall.json 
validation checking with json-schema-validator
--- BEGIN 
C:\x3d-code\www.web3d.org\x3d\content\examples\Vrml2Sourcebook\Chapter30Scripts\Figure30_1ScriptSlidingBall.json---
validation: FAILURE
[ {
   "level" : "error",
   "schema" : {
     "loadingURI" : 
"file:/C:/x3d-code/www.web3d.org/specifications/x3d-3.3-JSONSchema.json#",
     "pointer" : "/definitions/Script/properties/@url/items"
   },
   "instance" : {
     "pointer" : "/X3D/Scene/-children/3/Group/-children/8/Script/@url/0"
   },
   "domain" : "validation",
   "keyword" : "format",
   "attribute" : "uri",
   "message" : "string \"ecmascript: function set_fraction( fraction eventTime ) 
{ value_changed[0] = fraction; value_changed[1] = 0.0; value_changed[2] = 0.0; 
}\" is not a valid URI",
   "value" : "ecmascript: function set_fraction( fraction eventTime ) { 
value_changed[0] = fraction; value_changed[1] = 0.0; value_changed[2] = 0.0; }"
} ]
--- END 
C:\x3d-code\www.web3d.org\x3d\content\examples\Vrml2Sourcebook\Chapter30Scripts\Figure30_1ScriptSlidingBall.json---

====================================

http://www.web3d.org/x3d/content/examples/Vrml2Sourcebook/Chapter30Scripts/Figure30_1ScriptSlidingBall.x3d

<Script DEF='MoverUsingUrlScript' url='"ecmascript: function 
set_fraction( fraction eventTime ) { value_changed[0] = fraction; 
value_changed[1] = 0.0; value_changed[2] = 0.0; }"'>
         <field accessType='inputOnly' name='set_fraction' type='SFFloat'/>
        <field accessType='outputOnly' name='value_changed' type='SFVec3f'/>
       </Script>

====================================

http://www.web3d.org/x3d/content/examples/Vrml2Sourcebook/Chapter30Scripts/Figure30_1ScriptSlidingBall.json

{
   "#comment":"Second Script example: executable code is placed in url field. 
This is legal, but no longer a recommended approach."
},
{
   "#comment":"Warning: avoid // inline comments or else canonicalization will 
hide all follow-on code!"
},
{ "Script":
   {
     "@DEF":"MoverUsingUrlScript",
     "@url":["ecmascript: function set_fraction( fraction eventTime ) { 
value_changed[0] = fraction; value_changed[1] = 0.0; value_changed[2] = 0.0; }"],
     "field": [
       {
         "@name":"set_fraction",
         "@accessType":"inputOnly",
         "@type":"SFFloat"
       },
       {
         "@name":"value_changed",
         "@accessType":"outputOnly",
         "@type":"SFVec3f"
       }
     ]
   }
},

====================================

all the best, Don
-- 
Don Brutzman  Naval Postgraduate School, Code USW/Br brutzman at nps.edu
Watkins 270,  MOVES Institute, Monterey CA 93943-5000 USA +1.831.656.2149
X3D graphics, virtual worlds, navy robotics http://faculty.nps.edu/brutzman

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://web3d.org/pipermail/x3d-public_web3d.org/attachments/20170820/1b16d0c0/attachment-0001.html>