Validate your Tag Library Descriptor files!

Validate your Tag Library Descriptor files!

Prior to JSP 2.0, Tag Library Descriptor (TLD) files had to conform to a DTD file (e.g., web-jsptaglibrary_1_2.dtd in JSP 1.2). According to the DTD, a TLD was required to specify the version of the JSP specification it relied upon, by using the <jsp-version> subelement of the <taglib> root element.

For example, the TLD of the JSTL 1.0 Core Library component declares the JSP version as follows:

<?xml version="1.0" encoding="ISO-8859-1" ?>
<!DOCTYPE taglib
  PUBLIC "-//Sun Microsystems, Inc.//DTD JSP Tag Library 1.2//EN"
  "http://java.sun.com/dtd/web-jsptaglibrary_1_2.dtd">
<taglib>
  <tlib-version>1.0</tlib-version>
  <jsp-version>1.2</jsp-version>
  <short-name>c</short-name>
  <uri>http://java.sun.com/jstl/core</uri>
  <display-name>JSTL core</display-name>
  <description>JSTL 1.0 core library</description>
  ....
</taglib>

As of JSP 2.0, TLDs must conform to a schema (web-jsptaglibrary_2_0.xsd in JSP 2.0, and web-jsptaglibrary_2_1.xsd in JSP 2.1). One of the subtle changes between the transition from a DTD to a schema has affected the way the JSP specification version must be declared: The TLD schemas no longer define any <jsp-version> element. Instead, they require the JSP version to be declared as an attribute of the <taglib> root element!

For example, the TLD of the JSTL 1.1 Core Library component, which leverages JSP 2.1 features, declares the JSP version as follows:

<?xml version="1.0" encoding="UTF-8" ?>
<taglib xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-jsptaglibrary_2_1.xsd"
    version="2.1">

  <description>JSTL 1.1 core library</description>
  <display-name>JSTL core</display-name>
  <tlib-version>1.1</tlib-version>
  <short-name>c</short-name>
  <uri>http://java.sun.com/jsp/jstl/core</uri>
  ....
</taglib>

As some tag library developers have upgraded their JSP 1.2 based tag libraries to take advantage of JSP 2.0 or JSP 2.1 features, they forget to remove the <jsp-version> element from their TLDs. This error has gone unnoticed when deploying those tag libraries onto GlassFish, because by default, schema validation of tag libraries has been disabled in GlassFish.

Starting with GlassFish b42, you can enable schema validation of TLDs in several ways:

• By using the ${glassfish.home}/bin/jspc precompilation tool and specifying its new -validate option.

• By specifying the enableTldValidation property in your sun-web.xml, as follows:

  
  <?xml version="1.0" encoding="UTF-8"?>
  <sun-web-app>
      <property name="enableTldValidation" value="true" />
  </sun-web-app>
  

I recommend you validate your TLDs as a sanity check. We've found that some of the TLDs we've been using for testing were not schema compliant!

TLD schema validation in GlassFish leverages the schema validation framework provided by JAXP 1.3.

Notice that with GlassFish b42, only TLDs that reference a schema will be validated: If your TLD references a DTD, it will not be validated. This is because JAXP's javax.xml.parsers.DocumentBuilderFactory does not support the http://apache.org/xml/features/validation/dynamic feature. In any environment (such as JSP compilation) where an XML document (in this case: a TLD) may be DTD or schema based, and the parser does not have any advance knowledge of the type of document definition used, the lack of support for the http://apache.org/xml/features/validation/dynamic feature would require any document that needs to be validated against a DTD to be parsed twice: The first time in order to determine whether the XML document references a DTD or schema, and the second time to parse it with DTD validation enabled, by calling setValidating(true) on the javax.xml.parsers.DocumentBuilderFactory.

I've submitted a bug against JAXP to add support for the http://apache.org/xml/features/validation/dynamic feature to javax.xml.parsers.DocumentBuilderFactory. Once this feature is supported, enabling DTD validation of TLDs will be as simple as adding a single line to the TLD validation logic of the JSP compiler.

Posted at 01:38PM Apr 06, 2006 by Jan Luehe in Sun  |  Comments[0]