Is normalization to single-space problematic? - N-Infra #129

XMLWordPrintableJSON

    • Type: Change Request
    • Resolution: Persuasive
    • Priority: Medium
    • FHIR Core (FHIR)
    • STU3
    • FHIR Infrastructure
    • XML
    • Hide

      Persuasive: Allowing whitespace other than single spaces in attribute values and in the XHTML in the Narrative would contradict the normalization requirements defined in https://www.w3.org/TR/xmldsig-core1/#sec-Canonical (which requires xml attribute normalization – and which FHIR requires as part of its XML canonicalization – "Using the XML canonical method Canonical XML 1.1")

      The canonicalization is mentioned in the context of digital signatures. The Signature data type explicitly references XML digital signature https://www.w3.org/TR/xmldsig-core1/ that in turn requires use of Canonical XML https://www.w3.org/TR/xml-c14n11/. This means that XML attributes will be normalized, if XML dsig is used.

      We should add a note to the http://hl7.org/fhir/datatypes.html#signature and http://hl7.org/fhir/xml.html#digsig to indicate that following this normalization procedure could assign the same normalized text to resources with different meanings, since whitespace matters in markdown text, and FHIR's XML representation serialized the markdown datatype in XML attributes.

      Zulip discussion at https://chat.fhir.org/#narrow/stream/179166-implementers/topic/Canonicalization/near/175930107


      Original resolution from 4/22 (now over-ruled)
      Rick Geimer/Ron Shapiro: 8-0-0

      The canonicalization algorithm should not normalize information within XML attribute values or JSON object properties (excepting XHTML, where normalization SHALL happen normally). The change will be to restrict normalization to the XHTML content and to content outside XML attribute and JSON property values.

      Grahame will raise this with the community and see if this will actually impact anyone - and more importantly whether anyone objects to making this breaking change.

      If the community is agreeable, we will flag this in the R4 spec as having been fixed in the R5 spec and will fix it there.

      If the community is not agreeable, we will define new canonicalization algorithm URLs for the new "corrected" version.

      Show
      Persuasive: Allowing whitespace other than single spaces in attribute values and in the XHTML in the Narrative would contradict the normalization requirements defined in https://www.w3.org/TR/xmldsig-core1/#sec-Canonical (which requires xml attribute normalization – and which FHIR requires as part of its XML canonicalization – "Using the XML canonical method Canonical XML 1.1") The canonicalization is mentioned in the context of digital signatures. The Signature data type explicitly references XML digital signature https://www.w3.org/TR/xmldsig-core1/ that in turn requires use of Canonical XML https://www.w3.org/TR/xml-c14n11/ . This means that XML attributes will be normalized, if XML dsig is used. We should add a note to the http://hl7.org/fhir/datatypes.html#signature and http://hl7.org/fhir/xml.html#digsig to indicate that following this normalization procedure could assign the same normalized text to resources with different meanings, since whitespace matters in markdown text, and FHIR's XML representation serialized the markdown datatype in XML attributes. Zulip discussion at https://chat.fhir.org/#narrow/stream/179166-implementers/topic/Canonicalization/near/175930107 Original resolution from 4/22 (now over-ruled) Rick Geimer/Ron Shapiro: 8-0-0 The canonicalization algorithm should not normalize information within XML attribute values or JSON object properties (excepting XHTML, where normalization SHALL happen normally). The change will be to restrict normalization to the XHTML content and to content outside XML attribute and JSON property values. Grahame will raise this with the community and see if this will actually impact anyone - and more importantly whether anyone objects to making this breaking change. If the community is agreeable, we will flag this in the R4 spec as having been fixed in the R5 spec and will fix it there. If the community is not agreeable, we will define new canonicalization algorithm URLs for the new "corrected" version.
    • Vassil Peytchev/Rick Geimer: 10-0-0
    • Clarification
    • Non-substantive

      Comment:

      "No whitespace other than single spaces" - is there not a risk that this rule will allow subtle changing of meaning - e.g. removing indentation levels?

      Summary:

      Is normalization to single-space problematic?

            Assignee:
            Unassigned
            Reporter:
            Lloyd McKenzie
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: