PhoenixmlDb.XQuery

ResourcePolicy

Immutable security policy controlling resource access for XSLT and XQuery engines.

#ResourcePolicy

Namespace: PhoenixmlDb.XQuery.Security

Immutable security policy controlling resource access for XSLT and XQuery engines.

#Properties

Name Description
AllowTransformFunction Whether a query or stylesheet may call fn:transform. True unless the host turns it off with ResourcePolicyBuilder.AllowTransformFunction.
InMemoryOnly No external access at all. Only in-memory documents provided via a custom resolver.
ServerDefault Deny-by-default for server deployments. No filesystem, no network, no DTDs, no xsl:evaluate. Only documents pre-loaded by the application or served by a custom resolver are accessible.
Unrestricted Backwards-compatible default: all schemes allowed, no limits beyond existing defaults.

#Methods

#Authorize(String,PhoenixmlDb.XQuery.Security.ResourceAccessKind,Uri)

Resolves

to the absolute URI a reader would open, checks it against this policy, and returns it. Readers must open the returned URI, not the input.

Parameters:

  • uriOrPath — An absolute URI, a rooted file-system path, or a relative reference.

  • access — The kind of access requested.

  • baseUri — Base for a relative reference; without one it is resolved against the current directory, as the file readers do.

Exceptions:

#CanonicalFileUri(Uri)

The

file:

URI of the canonical path: absolute, and with every symbolic link along it resolved, so a link inside an allowed directory that points outside it is judged by where it points.

#CanonicalPath(String)

The absolute path with every symbolic link along it resolved.

#IsAllowed(Uri,PhoenixmlDb.XQuery.Security.ResourceAccessKind)

Whether

may be accessed for

. A

file:

URI is judged by its canonical path (symbolic links resolved), which is also what

hands back for the reader to open.

A scheme allowed with ResourcePolicyBuilder.AllowScheme (or "*") admits every access kind. Otherwise access needs a rule of the requested kind: read rules (ResourcePolicyBuilder.AllowReadFrom) admit reads only, import rules imports only, write rules writes only. An empty rule list admits nothing, so a policy that allows reading files does not also allow importing a module or stylesheet from anywhere on disk.

A relative URI is never allowed: resolve it first (ResourcePolicy.Resolve), because what matters is the resource that would actually be opened.

#Resolve(String,Uri)

The absolute URI a reader would open for

: a rooted path (

/etc/x

,

C:\x

) is a

file:

URI, and a relative reference resolves against

or, without one, the current directory. Null if the input is neither a URI nor a path.

#TryAuthorize(String,PhoenixmlDb.XQuery.Security.ResourceAccessKind,Uri)

As

, returning

null

instead of throwing.