On 9/10/05, Guy Harris <gharris@xxxxxxxxx> wrote:
> An XML document without a <!DOCTYPE item after the <?xml item is perhaps
> illegal, but I've seen one in at least one capture; the current
> dissector appears to generate a bunch of "[ ERROR: Unrecognized text ]"
> errors for it. The text is
>
> <?xml version="1.0" encoding="iso-8859-1" ?><RecList_8><row> ...
it is not that there's no <!DOCTYPE, it is the name token that is
missing the underscore from the set of needles (it is missing the
colon too... ). I fixed it already, I'm integrating the dtd parser so
I won't be checking it in until later tomorrow.
> but the first protocol tree item is
>
> <? xml
>
> and that item covers the entire
>
> <?xml version="1.0" encoding="iso-8859-1" ?>
>
> item but only displays the "<? xml" part.
The field will be the tag so I think it should cover the entire tag.
The attributes are then other fields taht actually belong to the tag.
> (Also, "<?xml" turns into "<? xml" in the display, so you don't see the
> text exactly as it is in the packet.)
That's because I'm recomposing the text to fill the label using sprintf with
the name I extracted to search for the namespace.
I'll be extracting the string from the start offset until the end of the name.
So that it matches what is on the packet.
Tomorrow or the day after I'll be checking the dtd importer too.
I checked in the xml dissector sooner because I needed it as a checkpoint
to go ahead.
Luis
--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan