BaseX-Talk

basex-talk@mailman.uni-konstanz.de

1 participants
5252 discussions

Vulnerabilities in docker image
by Huib Verweij 05 Oct '22

05 Oct '22

Hi, we have built a docker image based on the 10.1 war (and 10.2 war). In Harbor, part of the OpenShift K8s platform that we use, the image is scanned for vulnerabilities. There are quite a few Criticals and Highs! Here’s a list of the most pressing CVEs: CVE package version Fixed in version ================================================================== CVE-2013-7285 com.thoughtworks.xstream:xstream 1.4.2 1.4.7 CVE-2021-21342 com.thoughtworks.xstream:xstream 1.4.2 1.4.16 and 5 more Criticals and a lot more Highs in XStream. There’s also a High in JDOM: CVE-2021-33813 org.jdom:jdom 1.1 The Aqua-Trivy plugin for the Docker Desktop-app reports the same CVEs. Especially the Criticals that are (presumably) easy to fix by upgrading the XStream package are in the way of deployment. Our image is based on tomcat:9-jre17-temurin, when I leave out the BaseX stuff it has just two Low CVEs. Btw, an up to date docker image on Docker Hub would be much appreciated. If it’s also available for the linux/arm64/v8 architecture that would be perfect! Kind regards, Huib.

2 1

Indent result for unit tests
by Tim Thompson 05 Oct '22

05 Oct '22

Hello, I've noticed that the "Indent results" button in the GUI does not seem to be working when running a test module from the GUI. I'm using BaseX 10.3 beta. All best, Tim -- Tim A. Thompson (he, him) Librarian for Applied Metadata Research Yale University Library www.linkedin.com/in/timathompson

2 1

Error: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
by ykhabins＠bellsouth.net 30 Sep '22

30 Sep '22

Hello, I am using BaseX v.10.2 More specifically launching basexserver.bat and using c# samples from the following link: https://github.com/BaseXdb/basex/tree/9/basex-api/src/main/c%23 Everything is work fine when a computer with the Windows 10 OS has the following security policy disabled: System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing https://docs.trendmicro.com/all/ent/sc/v3.0/en-US/cmcolh/t_fips.html Alas, I am working for the company where that security policy is enabled. And I am getting the following error: "This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms." This particular function is erroring out. private string MD5(string input) { MD5CryptoServiceProvider MD5 = new MD5CryptoServiceProvider(); ... } I did some research and collected the following useful links: https://stackoverflow.com/questions/14509354/this-implementation-is-not-part -of-the-windows-platform-fips-validated-cryptogra https://docs.trendmicro.com/all/ent/sc/v3.0/en-US/cmcolh/t_fips.html https://stackoverflow.com/questions/6652850/enforcefipspolicy-flag-in-web-co nfig-doesnt-seem-to-working-for-web-application https://techcommunity.microsoft.com/t5/microsoft-security-baselines/why-we-a mp-8217-re-not-recommending-amp-8220-fips-mode-amp-8221/ba-p/701037 I also tried to add the following to the .config file to no avail: <configuration> <runtime> <enforceFIPSPolicy enabled="0" /> </runtime> </configuration> Is it possible to modify c# samples to work on the computers where mentioned above security poilsy is enabled? Regards, Yitzhak Khabinsky

1 0

BaseX 10.1 bug in GET command?
by Gabriel Lorenzo 27 Sep '22

27 Sep '22

Hello, I think I've found a possible bug. When I use the GET command the document retrieved is not always the same I requested. It only happens with the GET command, as using db:get() from xquery always works as expected. I haven't observed it happening with BINARY GET. I've reproduced it with the simplest example: BaseX 10.1 [Client]Try 'help' to get more information. > create db sample Database 'sample' created in 14.0 ms. > open sample Database 'sample' was opened in 0.03 ms. > add to hello.xml <hello>world</hello> Resource(s) added in 2.25 ms. > add to goodbye.xml <goodbye>world</goodbye> Resource(s) added in 2.22 ms. > get hello.xml <goodbye>world</goodbye>Query executed in 0.18 ms. > get goodbye.xml <hello>world</hello>Query executed in 0.19 ms. > xquery db:get('sample','hello.xml') <hello>world</hello> Query "BaseX" executed in 0.64 ms. > xquery db:get('sample','goodbye.xml') <goodbye>world</goodbye> Query "BaseX" executed in 0.23 ms. > I'm using BaseX 10.1 on Windows 10 with OpenJDK Temurin-17.0.4.1+1 Regards, Gabriel Lorenzo

2 1

Full text search with non-Latin scripts
by Andreas Hartmann 26 Sep '22

26 Sep '22

Hi, I have problems with full text search in 10.1, when non-Latin script is involved. Expressions such as "βάναυσος" contains text "67644567" using fuzzy "67644567" contains text "βάναυσος" using fuzzy "humbug" contains text "βάναυσος" using fuzzy all yield "true". It's the same with Hebrew strings. It does not matter which Greek/Hebrew word is used, as long as the word-length does not differ too much from the compared string. Is this really the expected behavior or could it be a bug? Best greetings Andreas

2 1

file:descendants() returns relative paths
by Hans-Jürgen Rennau 26 Sep '22

26 Sep '22

Dear BaseX people, functions file:descendants and file:children return relative paths, if input parameter $dir is a relative folder path. I regard this as a bug - relative folder paths should be resolved against the current working directory, so that a relative path and the corresponding absolute path are equivalent parameters. The functions should always return absolute paths, as the documentation promises. After all, a key use case is to find files which to access, and the accessor functions (doc(), json:doc(), unparsed-text() etc.) do *not* resolve relative paths against the current working dir. Kind regards, Hans-Jürgen

4 9

Full Text bug (?) - window ... words
by Hans-Juergen Rennau 26 Sep '22

26 Sep '22

Dear BaseX people, it seems to me there is a bug concerning Full Text Search, using option "window": let $text1 := '1 The usability of a Web site is how well the site' let $text2 := '2 The usability of a Web site is how well the sitx'let $text3 := '3 The usability of a Web site is how well the site'return ( $text1[. contains text 'usability web site' all words window 5 words], $text2[. contains text 'usability web site' all words window 5 words], $text3[. contains text 'usability web site' all words window 10 words] ) This query should return all three, $text1, $text2 and $text3, but it only returns $text2 and $text3. So it seems to me that the implemented logic is: "all matches of the "all words" search must be within a 5-words window, but it should be "there is a match of the "all words" search which is within a 5-words window. More detailed argument in PS. Kind regards,Hans-Jürgen PS: Compare https://www.w3.org/TR/xpath-full-text-30/#ftwindow "A window selection examines the matches generated by the preceding portion of the FTSelection, and selects those for which the matched tokens and phrases (more precisely, the individual StringIncludes of that match) are all found within a window whose size is a specified number of FTUnits (words, sentences, or paragraphs); for each such window, the window selection then generates a match containing the merge of those StringIncludes, plus any StringExcludes that fall within the window." (Italic added by me) The detailed semantics are given in 4.2.4 FTWords [1]. Pseudo-function fts:applyFtWordsAllWord() constructs for each of the words an fts:allMatches element and then performs conjunction of these elements, based on recursive application of 4.3.6.2 FTAnd [2]. Each fts:allMatches element contains one fts:match element for each occurrence of the word in question. The "ANDing" of two fts:allMatches is described by pseudo-function fts:ApplyFTAnd(), which creates one match for each pair of matches found in the operands - in other words, all combinations of operand matches are considered. As an example consider: "foo bar" all words and assume "foo" occurs two times and "bar" occurs two times. The fts:allMatches element representing the result is the result of applying fts:ApplyFTAnd() to two fts:allMatches elements, one obtained for word "foo", one obtained for word "bar". Schematically: $fts:allMatches_foo: <fts:match>foo(1)</fts:match> <fts:match>foo(2)</fts:match> $fts:allMatches_bar: <fts:match>bar(1)</fts:match> <fts:match>bar(2)</fts:match> fts:applyFTAnd($fts:allMatches_foo, $fts:allMatches_bar) is a single fts:allMatches containing four matches, each one of which is a combination of matches found in the operands: <fts:allMatches_allwords> = <fts:match>foo(1), bar(1)</fts:match> <fts:match>foo(1), bar(2)</fts:match> <fts:match>foo(2), bar(1)</fts:match> <fts:match>foo(2), bar(2)</fts:match> Now extend the query to "foo bar" all words window 5 words The result is true, if there is at least one combination of occurrences of "foo" and "bar" found in a window of at most 5 for word "bar". Referring to the semantic intermediates: if <fts:allMatches_allwords> contains at least one <fts:match> element for which all contained matches satisfy the window condition. [1] https://www.w3.org/TR/xpath-full-text-30/#tq-ft-fs-FTWords[2] https://www.w3.org/TR/xpath-full-text-30/#tq-ft-fs-FTAnd

2 1

Java 11
by Giuseppe G. A. Celano 13 Sep '22

13 Sep '22

Hi All, On the BaseX website (https://basex.org/download/ <https://basex.org/download/>), it is specified that “Java 11 is required to install and run BaseX (10.1)” . Since it is not specified “Java 11 or higher”, I am wondering whether this requirement is actually meant to be strict. Thanks! Best, Giuseppe

2 1

current-dateTime() function precision
by ykhabins＠bellsouth.net 09 Sep '22

09 Sep '22

Hello, I am using BaseX v.10.1 It seems that the current-dateTime() function precision is off. I am validating an XML file against an XSD 1.1 file via Xerces 2.12.2 validator. And trying to measure a timing of it. Here is my code. xquery version "4.0"; let $xml := '\\...\AForm-XSD-20211013\PD220224062681.XML' let $xsd := '\\...\AForm-XSD-20211013\Miami-ws-AForm.xsd' let $before_datetime := current-dateTime() let $result := validate:xsd-report($xml, $xsd, map { 'http://apache.org/xml/features/validation/cta-full-xpath-checking': true() }) return <root><metadata> <result>{data($result/status)}</result> <errors>{count($result/message)}</errors> <startTime>{$before_datetime}</startTime> <endTime>{current-dateTime()}</endTime> <xmlFile>{$xml}</xmlFile> <xsdFile>{$xsd}</xsdFile> <xsdProcessor>BaseX {data(db:system()//version)}, EE-Java, {validate:xsd-processor()} 2.12.2</xsdProcessor> <xsdVersion>{validate:xsd-version()}</xsdVersion> </metadata> <messages>{$result/message}</messages> </root> It is emitting the following output: <root> <metadata> <result>invalid</result> <errors>3</errors> <startTime>2022-09-09T11:32:29.667-04:00</startTime> <endTime>2022-09-09T11:32:29.667-04:00</endTime> <xmlFile>\\...\AForm-XSD-20211013\PD220224062681.XML</xmlFile> <xsdFile>\\...\AForm-XSD-20211013\Miami-ws-AForm.xsd</xsdFile> <xsdProcessor>BaseX 10.1, EE-Java, Xerces 2.12.2</xsdProcessor> <xsdVersion>1.1</xsdVersion> </metadata> <messages> ... </messages> </root> The question is why the before and after timing is the same: <startTime>2022-09-09T11:32:29.667-04:00</startTime> <endTime>2022-09-09T11:32:29.667-04:00</endTime> They are identical up to a millisecond. My expectations were that at least the millisecond time portion would be different. Regards, Yitzhak Khabinsky

3 8

Copy Modify Return - base URI preserved?
by Hans-Juergen Rennau 07 Sep '22

07 Sep '22

Dear BaseX people, I just observed that a document obtained by applying Copy/Modify/Return to a source document preserves its base URI, that is, base-uri($resultDoc) = base-uri($sourceDoc). That is marvellous, but can I rely on this as a feature? (In comparison - if I obtained the result document in a "conventional" way by recursive processing of the source document, the base URI would be lost, unless I added an @xml:base.) Kind regards,Hans-Jürgen

2 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

BaseX-Talk