Validate namespaces during deserialization

[Luki de Silva]

Hello all,

I am trying to get Jackson XML deserializer to ensure that XML elements that have been qualified by a namespace in the target POJO is correctly handled.

This is my POJO class.

@XmlRootElement(name = "open", namespace="foo")
public static class OpenStream {

  @XmlAttribute
  private String id;

  public OpenStream() {}
}

As you can see, the root element "open" is qualified by the "foo" namespace.

And this is the code I am running to deserialize the some XML to this POJO.

@Test
public void testJAXB_JacksonWoodstox() throws Exception {
   XMLInputFactory2 inputFactory = new WstxInputFactory();
   inputFactory.configureForSpeed();

   XMLOutputFactory2 outputFactory = new WstxOutputFactory();
   outputFactory.configureForSpeed();

   XmlMapper mapper = new XmlMapper(new XmlFactory(inputFactory, outputFactory));
   mapper.registerModule(new JaxbAnnotationModule());

   OpenStream open = mapper.readValue("<open id=\"1\"/>", OpenStream.class);
   assertEquals("1", open.id);
}

The XML string input to mapper does not have the "foo" namespace, and therefore I expect Jackson to FAIL the operation. However, it happily deserializes the XML and creates the POJO.

I tested the identical XML through standard JAXB (coupled with Woodstox) which throws an exception, as expected, with the following message.

unexpected element (uri:"", local:"open"). Expected elements are <{foo}open>]

Am I missing something or is this behaviour not available in Jackson?

Cheers,

Luki

[Tatu Saloranta]

You are correct: Jackson does not verify matching of the namespaces
currently: it will produce expected namespaces on generation but
basically ignore them on reading.

-+ Tatu +-

[Luki de Silva]

Thank you for the prompt response Tatu :)

I was wondering if I had incorrectly configured Jackson or the XML parser. So your confirmation is much appreciated.

Luki

[Tatu Saloranta]

On Sun, Jun 27, 2021 at 1:53 PM Luki de Silva <lak...@gmail.com> wrote:
>
> Thank you for the prompt response Tatu :)
> I was wondering if I had incorrectly configured Jackson or the XML parser. So your confirmation is much appreciated.

Right. For what it's worth it would obviously be good to be able to
verify namespace information and Jackson does keep track of expected
namespace URL.
But it is not used when matching incoming element/attribute name to
defined property; originally due to limitations in representation of
property names.
As things are, `PropertyName` does container the namespace definition
too so it would be possible (but not necessarily easy) to change
things to allow verification.

But at the very least module README should include this information on
not verifying namespace match.

-+ Tatu +-

> --
> You received this message because you are subscribed to the Google Groups "jackson-user" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to jackson-user...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/jackson-user/4259470d-ff5b-4359-8671-915d5d8fc06an%40googlegroups.com.

[Luki de Silva]

Agreed. It would be good to update the README for now with this limitation. Hopefully the Jackson team will could at some point look at implementing the capability interpret XML namespace semantics when reading an XML stream.

Cheers,

Luki