none
Can a WSDL contain an XML with out schema-Instance as namespace RRS feed

  • Question

  • Hi Team,

    I have a WSDL contain an XML with out schema-Instance as namespace . This WSDL is inpected by F5 ASM as XML Parser Attack and says Illegal prefix for 'http://www.w3.org/****/XMLSchema-instance' namespace, expecting 'xsi:'

    Application is SharePoint 2010



    Regrads

    Ahmed

    iahmed123

    Thursday, September 22, 2016 11:05 AM

All replies

  • What ever F5 ASM is, that message is nonsense. See XML Schema instance namespace. Cause it's only a recommendation.

    Especially as 2.6 Schema-Related Markup in Documents Being Validated:

    XML Schema: Structures also defines several attributes for direct use in any XML documents.  These attributes are in a different namespace, which has the namespace name http://www.w3.org/2001/XMLSchema-instance. For brevity, the text and examples in this specification use the prefix xsi: to stand for this latter namespace; in practice, any prefix can be used.
    Thursday, September 22, 2016 11:48 AM
  • Hi Stefen,

    Thanks for the information, so this means I can use any Prefix, and not just XSi:?

    Also can you please review if the below XML is correct.  This is the one which they F5 captured as XML Parser attack. I copied first few lines .

    <?xml version="1.0" encoding="utf-8"?>
    <wsdl:definitions xmlns:s="http://www.w3.org/2001/XMLSchema" xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/" xmlns:mime="http://schemas.xmlsoap.org/wsdl/mime/" xmlns:tns="http://tempuri.org/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/" xmlns:http="http://schemas.xmlsoap.org/wsdl/http/" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" targetNamespace="http://tempuri.org/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">
      <wsdl:types>
        <s:schema elementFormDefault="qualified" targetNamespace="http://tempuri.org/">
          <s:element name="GetSectorName">
            <s:complexType>
              <s:sequence>
                <s:element minOccurs="1" maxOccurs="1" name="intRegionID" type="s:int" />
              </s:sequence>
            </s:complexType>
          </s:element>
          <s:element name="GetSectorNameResponse">
            <s:complexType>
              <s:sequence>
                <s:element minOccurs="0" maxOccurs="1" name="GetSectorNameResult" type="tns:ArrayOfSectors" />
              </s:sequence>
            </s:complexType>
          </s:element>
          <s:complexType name="ArrayOfSectors">
            <s:sequence>
              <s:element minOccurs="0" maxOccurs="unbounded" name="sectors" nillable="true" type="tns:sectors" />
            </s:sequence>
          </s:complexType>
          <s:complexType name="sectors">
            <s:sequence>
              <s:element minOccurs="1" maxOccurs="1" name="SectorId" type="s:int" />
              <s:element minOccurs="0" maxOccurs="1" name="SectorNameAr" type="s:string" />
              <s:element minOccurs="0" maxOccurs="1" name="SectorNameEn" type="s:string" />
              <s:element minOccurs="0" maxOccurs="1" name="NoOfProjects" type="s:string" />
            </s:sequence>


    iahmed123

    Sunday, September 25, 2016 5:33 AM
  • It's incomplete and non-valid XML. But when I manually repair it:

    <?xml version="1.0" encoding="utf-8"?>
    <wsdl:definitions
    	xmlns:s="http://www.w3.org/2001/XMLSchema"
    	xmlns:soap12="http://schemas.xmlsoap.org/wsdl/soap12/"
    	xmlns:mime="http://schemas.xmlsoap.org/wsdl/mime/"
    	xmlns:tns="http://tempuri.org/"
    	xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
    	xmlns:tm="http://microsoft.com/wsdl/mime/textMatching/"
    	xmlns:http="http://schemas.xmlsoap.org/wsdl/http/"
    	xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" targetNamespace="http://tempuri.org/"
    	xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/">
      <wsdl:types>
        <s:schema elementFormDefault="qualified" targetNamespace="http://tempuri.org/">
          <s:element name="GetSectorName">
            <s:complexType>
              <s:sequence>
                <s:element minOccurs="1" maxOccurs="1" name="intRegionID" type="s:int" />
              </s:sequence>
            </s:complexType>
          </s:element>
    	</s:schema>
      </wsdl:types>
    </wsdl:definitions>

    Then it is - still incomplete - but the XML is valid. See also:

    - https://validator.w3.org/

    - https://www.wsdl-analyzer.com/

    Sunday, September 25, 2016 11:27 AM
  • Thanks a lot Stefan , 

     Will analyse using the validator. 

    regards

    Iahmed


    iahmed123

    Monday, September 26, 2016 5:08 AM
  • Hi Iahmed,

    Sorry to trouble you and I just want to know that your issue is solved or not.

    If not works, please share your result and it will help us to continue researching your issue, thank you for your understanding.

    Best regards,

    Sara


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place. Click HERE to participate the survey.

    Tuesday, September 27, 2016 9:11 AM
    Moderator
  • Hi Iahmed,

    Sorry to trouble you again, according to your description, your issue is more related to the SharePoint, and I found you already created the same thread on the SharePoint forum: https://social.msdn.microsoft.com/Forums/vstudio/en-US/c5a1ba20-cc19-4097-953b-c2d26e9f8f70/can-a-wsdl-contain-an-xml-with-out-schemainstance-as-namespace?forum=sharepointdevelopment, please keep your focus on this thread for dedicated information, you will get a better support from there, since our forum is to discuss the .NET Framework Setup and Servicing.

    If you have any issue about the installation of the .NET Framework, please feel free to let me know.

    Best regards,

    Sara


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place. Click HERE to participate the survey.

    Thursday, September 29, 2016 8:21 AM
    Moderator
  • Thanks Sara.

    Well Explained.

    Regards

    Iahmed


    iahmed123

    Wednesday, October 11, 2017 5:32 AM