BaseX-Talk March 2012

basex-talk@mailman.uni-konstanz.de

48 participants
60 discussions

BaseX 7.2: The EDBT Release
by Christian Grün 24 Mar '12

24 Mar '12

Dear subscribers, after some busy weeks, we are glad to announce BaseX 7.2, the EDBT Release! The latest version offers the following new features: * support for the new RESTXQ API for building XQuery web services [1] * improved support for running BaseX as web application [2] * XQuery: higher order functions added to speed up Top-K queries [3] * proxy server settings added [4] * advanced TagSoup options added for importing HTML files [5] * XQuery: faster traversal of full-text index entries via ft:tokens() [6] * Command-line: embedded readline and history support via JLine [7] * XQuery 3.0: annotation added, updated EQName syntax (Q{uri}name) * opened databases are now pinned OS-wide to reduce write conflicts * HTML5 serialization of query results * a printable version of our Wiki documentation As usual, more infos can be found on our homepage [8]. All your feedback is welcome. If you will be attending the EDBT Conference next week, we are looking forward to seeing you there, Christian, BaseX Team 2012 [1] http://docs.basex.org/wiki/RESTXQ [2] http://docs.basex.org/wiki/Web_Application [3] http://docs.basex.org/wiki/Higher-Order_Functions_Module#hof:top-k-by [4] http://docs.basex.org/wiki/Options#PROXYHOST [5] http://docs.basex.org/wiki/Parsers#Options [6] http://docs.basex.org/wiki/Full-Text_Module#ft:tokens [7] http://jline.sourceforge.net/ [8] http://basex.org/

2 1

BaseX Antivirus Scan Report on FileCluster.com
by FileCluster Security 23 Mar '12

23 Mar '12

Dear Developer,BaseX has been downloaded and tested by Filecluster Labs on 23 Mar 2012 with today's best antivirus engines: BitDefender Antivirus, Kaspersky Antivirus, NOD32 and Avira Antivirus. The report shows that BaseX has been found clean of any viruses or malware and has been flagged as safe to install. You can find the detailed antivirus scan reports at this page: http://www.filecluster.com/Antivirus-Report/BaseX.html. (if the page isn't working, please allow between 5-30 mins for the cache to refresh) Please keep in mind that we will constantly scan your software with each version update or on-demand, if necessary. We have also displayed a clean award within FileCluster to assure our visitors that BaseX is clean and safe to install.If you feel that this report could add value to your visitors as well, you can use any of the banners presented within the report page. Future development of this feature will depend on feedback, so any suggestions or general feedback are greatly appreciated. Also, mentioning this report onto your blog, news page or press releases is highly appreciated, encouraging us to improve the scanner and extend it even further. If you wish to unsubscribe from receiving such notifications, please contact us via email and let us know. Keep in mind that by unsubscribing, you will never receive any emails from FileCluster again, such as promotions, security reports, community feedback and so on. Don't hesitate to contact us for any issues regarding our security service. Best Regards, Jamie P. - FileCluster Security www.filecluster.com

1 0

Java functions, packages, and ADMIN privileges
by Charles Duffy 22 Mar '12

22 Mar '12

Howdy -- The ability to call arbitrary Java code from XQuery being accessible only to users with ADMIN privileges is generally sensible for obvious reasons. However, it would be useful for users with ADMIN privileges to be able to install packages in such a way as to make classes contained therein accessible to less-privileged users. Does such a mechanism already exist? If not, thoughts on feasibility?

2 3

webdav issue using oxygen
by Maximilian Gärber 22 Mar '12

22 Mar '12

Hi, following the steps on http://docs.basex.org/wiki/Integrating_oXygen for accessing resources via webdav, I guess it should be possible to change and save xml files. Doing so, actually empties the db and adds a "RAW" xml resource to it. This happens with the latest Snapshot (7.2). Any other Oxygen users out there? Regards, Max

2 1

Ask about BaseX event for more than one context
by truc.cam＠emotive.de 22 Mar '12

22 Mar '12

Dear BaseX team, Please see the attachment. When I use events for 2 contexts, just the first one can notify.If the notification of the 2rd context happens, the result should be "1 2 3 4". If I replace "xquery2.execute(context2)" by "xquery2.execute(context1)", I will receive right result. But this is not what I want to do. Thanks in advance. Best regards

2 1

REST API now returning exceptions as HTML?
by Charles Duffy 21 Mar '12

21 Mar '12

Howdy -- Historically, the BaseX REST API has handled exceptions by returning only the exception content itself. I just ran a build against current SVN, and received the following: <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"/> <title>Error 400 Stopped at line 1, column 75: [XPST0017] Unknown Java function 'net.dyfis.svnkit_wrapper.SvnWrapper.cat(...)'.</title> </head> <body><h2>HTTP ERROR 400</h2> Problem accessing /rest. Reason: <pre> Stopped at line 1, column 75: [XPST0017] Unknown Java function 'net.dyfis.svnkit_wrapper.SvnWrapper.cat(...)'.</pre><hr />Powered by Jetty:// </body> </html> Is this now desired/documented/ongoing behavior?

2 1

Debugging jar loading (Java interface)
by Charles Duffy 21 Mar '12

21 Mar '12

Howdy -- I'm trying to include (and use) a jar in a package, and not having any luck of it just yet. Could I get any guidance on what I might be missing here? === BEGIN expath-pkg.xml <package xmlns="http://expath.org/ns/pkg" spec="1.0" name="http://dyfis.net/svnkit-wrapper" abbrev="svnkit" version="0.1"> <title>Subversion Wrapper</title> <xquery> <namespace>http://dyfis.net/svnkit-wrapper</namespace> <file>svn.xq</file> </xquery> </package> === END expath-pkg.xml === BEGIN basex.xml <package xmlns="http://expath.org/ns/pkg"> <jar>svnkit-wrapper.jar</jar> <class>net.dyfis.svnkit_wrapper.SvnWrapper</class> </package> === END basex.xml === BEGIN svnkit/svn.xq module namespace svnkit = "http://dyfis.net/svnkit-wrapper"; declare namespace j="java:net.dyfis.svnkit_wrapper.SvnWrapper"; declare function svnkit:cat($path as xs:string) as xs:string { j:cat($path) }; declare function svnkit:cat($path as xs:string, $rev as xs:integer) as xs:string { j:cat($path, $rev) }; === END svnkit/svn.xq ...where "svnkit-wrapper.jar" contains a thin wrapper around TMate's SVNKit library, allowing direct access to Subversion resources through a simpler API (providing static functions only, abstracting away session management and the like). However, when I try to call svnkit:cat($subversion_url), the following is returned: [XPST0017] Unknown Java function 'net.dyfis.svnkit_wrapper.SvnWrapper.cat(...)'. I can call net.dyfis.svnkit.wrapper.SvnWrapper("") through Jython and other JVM-based interpreters, so I'm confident that the jar correctly exposes it. Any pointers on what I might be doing wrong in the packaging?

1 2

Re: [basex-talk] Use of unsalted password hashes
by Dimitar Popov 18 Mar '12

18 Mar '12

Am Sonntag, 18. März 2012, 12:16:48 schrieb Charles Duffy: > On Sun, Mar 18, 2012 at 10:16 AM, Dimitar Popov < > Dimitar.Popov(a)uni-konstanz.de> wrote: > > > Am Sonntag, 18. März 2012, 09:08:36 schrieb Charles Duffy: > > > Caching accepted username/password pairs in RAM, and maintaining a > > > separate pool using the credentials for each such pair, would _work_, > > > but it would mean that you'd have to be careful not to let the memory > > > that information is stored in get swapped to disk -- writing users' > > > passwords to disk, even by way of the OS's swap operations, being a > > > serious no-no. > > > > The pairs username/password can be, of course, hashed and additionally, > > swap > > partitions can be encrypted, if such a level of security is required. > > > > Hashing could work, but adds a requirement that only basic auth be > supported. Given the number of other credential-proving mechanisms in the > world (Kerberos, NTLM, etc), this seems a very unfortunate limitation to > place on future development. > > As for encrypted swap -- in a typical commercial environment, that's > outside of the dev team's control unless they bother to do a great deal of > paperwork and politics; in short, not an acceptable solution. > > AFAIK, JCA provides a keystore mechanism, which I guess, provides enough > > means > > of protection against steal. I'm, however, too lazy to thoroughly read the > > JCA > > guide [1], but the first which comes to my mind is for example, external > > storage of keys. > > > > Again, to make that keystore secure, you're creating requirements that the > typical user won't implement. Better to design things to be secure > out-of-the-box, rather than "secure if only you do A, B, C and D". Well, then it seems after all, that the token alternative provides the highest degree of flexibility and security :) I guess, if there are no other suggestions, it should be discussed how to implement it. Regards, Dimitar

1 0

Use of unsalted password hashes
by Charles Duffy 18 Mar '12

18 Mar '12

Howdy -- I'm a bit concerned about storing password hashes unsalted -- compared to a salted hash, this makes a stolen database easier to retrieve user passwords from, dangerous if users use their passwords for other purposes as well. Would salting (and perhaps stretching) the hashes be considered a reasonable feature to support in the future?

4 16

Setting the context item via the native protocol
by Charles Duffy 17 Mar '12

17 Mar '12

Howdy -- Right now, I'm aware of two ways to set the context item via the native protocol: (1) Insert a "declare context item" header into the document - Disadvantage: Should only work when XQUERY3 is true - Disadvantage: Modifies line/column references for errors received - Disadvantage: Hard to ensure that user-provided XML document will evaluate to itself in XQuery (security risk) (2) Use the "CS" ["Context Set"] command - Disadvantage: Requires a database to be open (why?) - Disadvantage: Hard to ensure that user-provided XML document will evaluate to itself in XQuery (security risk) Is there a better approach?

2 8

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

BaseX-Talk March 2012