redhat-developer / redhat-developer/vscode-xml

CodeAction to activate `xml.validation.resolveExternalEntities` to true

Open
#810 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug codeaction DTD
Dominant language
TypeScript
Stars
328
Forks
101
Avg merge
1d 17h
Merged PRs (30d)
7

Description

By default xml.validation.resolveExternalEntities is set to false for security issue. It is nice but it can be hard for user to know why XML validation / completion based on DTD doesn't work when xml.validation.resolveExternalEntities is set to false.

I encountered the problem and I though it was a bug from LemMinx, but after debugging LemMinx I noticed that it was just a problem with xml.validation.resolveExternalEntities which should be set to true.

Here my usecase.

  • my xml.validation.resolveExternalEntities was set to false.
  • I open vscode
  • I created a SVG file like this:
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="5cm" height="4cm" version="1.1"
	xmlns="http://www.w3.org/2000/svg">
</svg>
  • LemMinx download the DTD and after that I see those error:

image

  • at this step, I had the impression that LemMinx was bugged, but the fix is to set xml.validation.resolveExternalEntities to true
  • but even if you swith this setting to true, you have again the error. You have validation error and completion based on DTD doesn't work.
  • you need to close vscode and reopen it. And now validation and completion based on DTD is working:

image

We need really improve that:

  • provide a code action which set xml.validation.resolveExternalEntities to true
  • the validation and completion based on DTD should work when this setting is set to true (it is a matter of cache that it should be evicted). See https://github.com/eclipse/lemminx/issues/1123

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how the vscode-xml extension handles xml.validation.resolveExternalEntities and how LemMinx caches DTD resolution; the issue links LemMinx issue 1123 as related context. Done means a code action can enable the setting and validation and DTD completion update without restarting VS Code.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript, vscode
Domain
developer-experience, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.