moxml 0.5.162 → 0.5.163

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e3ff9c9a02aad66036e51b20f9dd72fb17adb09b51dbe3950bb5a5174a2f2158
-  data.tar.gz: b4924b020e3b4738e08197d918594df3269d5206fda86ab0f582b27e801a1dbf
+  metadata.gz: 66e9a76f3fb1a9a8e41d39d3f49c6ea97536a1d08a7aaf145169eb2ca8b2e72e
+  data.tar.gz: 5190677a144235ce163990b3cd3f7f6ef2a123ef4e02b1b81626e2467d74bcaf
 SHA512:
-  metadata.gz: dcb4225b3f662a656232b4e4bccdaefeb261a186d9c01d5369ee54ec28829678202e69349372842e470dcd21bed702f6f28c0e58dc9e45b6c262fffab1ed937a
-  data.tar.gz: 22fa41a31b5a8541e2c3f5fa2c8eb088975f173902ff8c046e325ec55c28246e3c459df5e49d004fb2e89ea1d1d8f9adb841d71cae8e4fe8bfaea14cd25c5d7c
+  metadata.gz: 8dae5f5b85c572bf5f31efff0dcd1694854a5fffcf03feb066997136b53a44e2423a8208c08944c2159cd28ecdf83954cfe9856ed8354597d8ae8a664d7c434f
+  data.tar.gz: 0347c21ed0aecc388117e2c69632f9be715f0f1a073b5ac1dfad06fc8a0760cf07d652fc7cb39b0641ff5358b8a0d075f22de71befa72bdd687e24bf9ea1f2b4

data/docs/_references/processing-model.adoc

@@ -263,9 +263,11 @@ checks). `validate` returns accumulated `ValidationError` entries —
 message always; line/column/path where the engine reports them, nil
 where it does not; `[]` means valid. Documents outside the engine's
 scope validate laxly, except that strict `xs:any` /
-`xs:anyAttribute` wildcard matches and `xsi:nil` are re-checked from
-the schema source on every adapter — the re-check can only
-under-report, never false-report. A compiled schema reports the
+`xs:anyAttribute` wildcard matches, `xsi:nil`, and the XSD 1.1
+negative wildcards (`notQName` / `notNamespace` — an item excluded
+by them has no particle and the content model cannot accept it) are
+re-checked from the schema source on every adapter — the re-check
+can only under-report, never false-report. A compiled schema reports the
 version its source declares: root `vc:minVersion="1.1"` scopes the
 document to 1.1, anything else is 1.0 (consumers scope 1.0-only
 checks with it; applying 1.1 semantics is the engine-side program).

data/lib/moxml/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Moxml
-  VERSION = "0.5.162"
+  VERSION = "0.5.163"
 end

data/lib/moxml/xsd/schema_rules.rb

@@ -8,7 +8,11 @@ module Moxml
     #
     #   * a strict `xs:any` wildcard with an undeclared element,
     #   * a strict `xs:anyAttribute` with an undeclared attribute,
-    #   * `xsi:nil` on an element whose declaration is not nillable.
+    #   * `xsi:nil` on an element whose declaration is not nillable,
+    #   * the XSD 1.1 negative wildcards — `notQName` /
+    #     `notNamespace` on `xs:any` / `xs:anyAttribute` (#460):
+    #     engines that compile them without enforcing them absorb
+    #     excluded items the content model cannot accept.
     #
     # The rules run from an index of the schema SOURCE (this gem's
     # own XML machinery — no engine involvement) and merge with the
@@ -20,22 +24,18 @@ module Moxml
     module SchemaRules
       XSI_NS = "http://www.w3.org/2001/XMLSchema-instance"
 
-      # A wildcard's namespace attribute, per XML Schema
-      # Structures §3.10.2 (##any default; processContents default
-      # strict). :tns / :local are resolved against the indexed
-      # schema at check time.
+      # A wildcard's namespace constraint and disallowed names, per
+      # XML Schema Structures §3.10.1–3.10.2 (##any default;
+      # processContents default strict; notNamespace / notQName are
+      # XSD 1.1). :tns / :local are resolved against the indexed
+      # schema at check time; notQName QNames are resolved against
+      # the schema element's in-scope bindings at index time.
       class Wildcard
-        def initialize(value, process)
+        def initialize(value, process, not_namespace: nil, not_qname: nil,
+                       element: nil)
           @process = (process || "strict").to_sym
-          case value
-          when nil, "##any", ""
-            @mode = :any
-          when "##other"
-            @mode = :other
-          else
-            @mode = :list
-            @namespaces = value.split(/\s+/).reject(&:empty?).freeze
-          end
+          @mode, @namespaces = namespace_constraint(value, not_namespace)
+          @disallowed = disallowed_names(not_qname, element).freeze
         end
 
         def strict?
@@ -47,13 +47,89 @@ module Moxml
           when :any then true
           when :other
             namespace != :local && namespace != :tns
+          when :not
+            @namespaces.none? { |entry| entry_covers?(entry, namespace) }
           else
             @namespaces.any? { |entry| entry_covers?(entry, namespace) }
           end
         end
 
+        # Why the wildcard refuses an item outright (Structures
+        # §3.10.4.1 Item Valid): a refusal is a match-level failure,
+        # so it applies at every processContents — the content model
+        # has no particle for the item and cannot accept it. 1.0
+        # namespace lists stay the engine's enforcement and never
+        # name an exclusion here.
+        def negative_exclusion(qname, namespace, defined:,
+                               sibling_names: [])
+          @disallowed.each do |entry|
+            case entry
+            when :defined
+              return :not_qname if defined
+            when :sibling
+              return :not_qname if sibling_names.include?(qname)
+            else
+              return :not_qname if entry == qname
+            end
+          end
+          return :not_namespace if @mode == :not &&
+            @namespaces.any? { |entry| entry_covers?(entry, namespace) }
+
+          nil
+        end
+
         private
 
+        def namespace_constraint(value, not_namespace)
+          if not_namespace
+            [:not, not_namespace.split(/\s+/).reject(&:empty?)]
+          elsif value.nil? || value == "##any" || value == ""
+            [:any, []]
+          elsif value == "##other"
+            [:other, []]
+          else
+            [:list, value.split(/\s+/).reject(&:empty?)]
+          end
+        end
+
+        # notQName entries (§3.10.2): QName | ##defined |
+        # ##definedSibling (xs:any; ##defined only on
+        # xs:anyAttribute). Prefixed QNames resolve against the
+        # wildcard element's in-scope bindings; unprefixed QNames
+        # carry no namespace — XSD QName values take no default
+        # namespace. Unresolvable prefixes are dropped: the index
+        # under-reports, never false-reports.
+        def disallowed_names(not_qname, element)
+          not_qname.to_s.split(/\s+/).reject(&:empty?).filter_map do |token|
+            case token
+            when "##defined" then :defined
+            when "##definedSibling" then :sibling
+            when /\A([^:]+):(.+)\z/
+              uri = prefix_uri(Regexp.last_match(1), element)
+              "{#{uri}}#{Regexp.last_match(2)}" unless uri.empty?
+            else
+              "{}#{token}"
+            end
+          end
+        end
+
+        # node.namespaces is adapter-divergent (some engines return
+        # in-scope bindings, others own-node declarations only), so
+        # the in-scope map is walked out by hand — per-node
+        # definitions merged along the ancestor axis, deeper
+        # overriding shallower, identically on every adapter.
+        def prefix_uri(prefix, element)
+          bindings = {}
+          node = element
+          while node
+            node.namespaces.each do |namespace|
+              bindings[namespace.prefix] = namespace.uri
+            end
+            node = node.parent&.element? ? node.parent : nil
+          end
+          bindings[prefix].to_s
+        end
+
         def entry_covers?(entry, namespace)
           namespace == case entry
                        when "##targetNamespace" then :tns
@@ -193,12 +269,9 @@ module Moxml
               add_particle(child, index, model,
                            model.declared_attributes)
             when "any"
-              model.any ||= Wildcard.new(child["namespace"],
-                                         child["processContents"])
+              model.any ||= wildcard_from(child)
             when "anyAttribute"
-              model.any_attribute ||=
-                Wildcard.new(child["namespace"],
-                             child["processContents"])
+              model.any_attribute ||= wildcard_from(child)
             else
               collect_model(child, index, model)
             end
@@ -234,19 +307,25 @@ module Moxml
           end
         end
 
+        def wildcard_from(node)
+          Wildcard.new(
+            node["namespace"], node["processContents"],
+            not_namespace: node["notNamespace"],
+            not_qname: node["notQName"],
+            element: node
+          )
+        end
+
         def child_findings(child, model, index)
           qname = qname(child)
           findings = []
           if model.declared_children.include?(qname)
             declaration = index.elements[qname]
             findings << nil_finding(child, declaration) if declaration
-          elsif undeclared_strict_wildcard_match?(child, model, index,
-                                                  qname)
-            findings << Moxml::XSD::ValidationError.new(
-              message: "element <#{local(qname)}> matches a strict " \
-                       "wildcard but is not declared",
-              path: path_of(child),
-            )
+          elsif model.any &&
+              (finding = wildcard_child_finding(child, model, index,
+                                                qname))
+            findings << finding
           end
           findings.concat(
             attribute_findings(child, index.contents[qname], index),
@@ -254,13 +333,34 @@ module Moxml
           findings
         end
 
-        def undeclared_strict_wildcard_match?(_child, model, index, qname)
+        def wildcard_child_finding(child, model, index, qname)
           wildcard = model.any
-          return false unless wildcard&.strict?
-          return false if index.elements.key?(qname)
-
           namespace = resolve_namespace(qname, index)
-          wildcard.covers?(namespace) && !index.elements.key?(qname)
+          exclusion = wildcard.negative_exclusion(
+            qname, namespace,
+            defined: index.elements.key?(qname),
+            sibling_names: model.declared_children
+          )
+          return excluded_child_finding(child, qname, exclusion) if exclusion
+
+          return unless wildcard.covers?(namespace) && wildcard.strict?
+          return if index.elements.key?(qname)
+
+          Moxml::XSD::ValidationError.new(
+            message: "element <#{local(qname)}> matches a strict " \
+                     "wildcard but is not declared",
+            path: path_of(child),
+          )
+        end
+
+        def excluded_child_finding(child, qname, exclusion)
+          reason = exclusion == :not_namespace ? "notNamespace" : "notQName"
+          Moxml::XSD::ValidationError.new(
+            message: "element <#{local(qname)}> is disallowed by a " \
+                     "wildcard (#{reason}) and is not declared in the " \
+                     "content model",
+            path: path_of(child),
+          )
         end
 
         def attribute_findings(element, model, index)
@@ -271,14 +371,19 @@ module Moxml
             next if attribute.namespace&.uri == XSI_NS
 
             qname = attribute_qname(attribute)
-            declared = model.declared_attributes.include?(qname) ||
-              index.attributes.key?(qname)
-            next if declared
-            next unless any_attribute&.strict?
-            next if index.attributes.key?(qname)
-            next unless any_attribute.covers?(
-              resolve_namespace(qname, index),
+            next if model.declared_attributes.include?(qname)
+            next unless any_attribute
+
+            namespace = resolve_namespace(qname, index)
+            exclusion = any_attribute.negative_exclusion(
+              qname, namespace,
+              defined: index.attributes.key?(qname)
             )
+            next excluded_attribute_finding(element, qname, exclusion) if exclusion
+
+            next unless any_attribute.covers?(namespace)
+            next unless any_attribute.strict?
+            next if index.attributes.key?(qname)
 
             Moxml::XSD::ValidationError.new(
               message: "attribute #{local(qname)} matches a strict " \
@@ -288,6 +393,16 @@ module Moxml
           end
         end
 
+        def excluded_attribute_finding(element, qname, exclusion)
+          reason = exclusion == :not_namespace ? "notNamespace" : "notQName"
+          Moxml::XSD::ValidationError.new(
+            message: "attribute #{local(qname)} is disallowed by a " \
+                     "wildcard (#{reason}) and is not declared in the " \
+                     "content model",
+            path: path_of(element),
+          )
+        end
+
         def nil_finding(element, declaration)
           return if declaration[:nillable]
 

data/spec/moxml/xsd_underdetection_spec.rb

@@ -4,11 +4,11 @@ require "spec_helper"
 
 # Processing model §Validation (normative): pinned here.
 # #452: tier-1 engines can accept, inside their recognized scope,
-# instances that violate strict wildcards or xsi:nil. The
-# Ruby-side SchemaRules post-validation closes those gaps from the
-# schema source; findings merge with the engine's (duplicates
-# dropped), so every adapter answers invalid for the four
-# corpus shapes.
+# instances that violate strict wildcards or xsi:nil. #460: engines
+# may compile the 1.1 negative wildcards without enforcing them.
+# The Ruby-side SchemaRules post-validation closes those gaps from
+# the schema source; findings merge with the engine's (duplicates
+# dropped), so every adapter answers invalid for the corpus shapes.
 RSpec.describe "Moxml::XSD tier-1 under-detections (#452)" do
   %i[nokogiri leptris].each do |adapter_name|
     describe "on #{adapter_name}" do
@@ -152,6 +152,172 @@ RSpec.describe "Moxml::XSD tier-1 under-detections (#452)" do
         end
       end
 
+      describe "negative wildcards (XSD 1.1, #460)" do
+        before do
+          if adapter_name == :nokogiri
+            skip "#{adapter_name} requires an XSD 1.1 wildcard-capable " \
+                 "engine"
+          end
+        end
+
+        describe "xs:any notQName naming an excluded element" do
+          let(:schema) do
+            ctx.xsd(<<~XSD)
+              <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
+                  xmlns:w="http://example.com/w"
+                  targetNamespace="http://example.com/w"
+                  elementFormDefault="qualified">
+                <xs:element name="container">
+                  <xs:complexType>
+                    <xs:sequence>
+                      <xs:any processContents="strict"
+                              notQName="w:banned" minOccurs="0"
+                              maxOccurs="unbounded"/>
+                    </xs:sequence>
+                  </xs:complexType>
+                </xs:element>
+                <xs:element name="banned" type="xs:string"/>
+                <xs:element name="known" type="xs:string"/>
+              </xs:schema>
+            XSD
+          end
+
+          it "rejects the excluded element although it is declared" do
+            doc = ctx.parse(
+              '<container xmlns="http://example.com/w"><banned>x</banned></container>',
+            )
+            expect(schema.valid?(doc)).to be(false)
+            expect(schema.validate(doc).map(&:message)).to include(
+              /disallowed by a wildcard \(notQName\)/,
+            )
+          end
+
+          it "accepts a wildcard-matched declared element" do
+            doc = ctx.parse(
+              '<container xmlns="http://example.com/w"><known>x</known></container>',
+            )
+            expect(schema.valid?(doc)).to be(true)
+          end
+        end
+
+        describe "xs:any notQName=##defined" do
+          let(:schema) do
+            ctx.xsd(<<~XSD)
+              <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
+                  targetNamespace="http://example.com/w"
+                  elementFormDefault="qualified">
+                <xs:element name="container">
+                  <xs:complexType>
+                    <xs:sequence>
+                      <xs:any processContents="lax"
+                              notQName="##defined" minOccurs="0"
+                              maxOccurs="unbounded"/>
+                    </xs:sequence>
+                  </xs:complexType>
+                </xs:element>
+                <xs:element name="known" type="xs:string"/>
+              </xs:schema>
+            XSD
+          end
+
+          it "rejects a declared element the ##defined wildcard excludes" do
+            doc = ctx.parse(
+              '<container xmlns="http://example.com/w"><known>x</known></container>',
+            )
+            expect(schema.valid?(doc)).to be(false)
+            expect(schema.validate(doc).map(&:message)).to include(
+              /disallowed by a wildcard \(notQName\)/,
+            )
+          end
+
+          it "absorbs an undeclared element laxly" do
+            doc = ctx.parse(
+              '<container xmlns="http://example.com/w"><unknown>x</unknown></container>',
+            )
+            expect(schema.valid?(doc)).to be(true)
+          end
+        end
+
+        describe "xs:any notNamespace" do
+          let(:schema) do
+            ctx.xsd(<<~XSD)
+              <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
+                  targetNamespace="http://example.com/w"
+                  elementFormDefault="qualified">
+                <xs:element name="container">
+                  <xs:complexType>
+                    <xs:sequence>
+                      <xs:any processContents="lax"
+                              notNamespace="##targetNamespace"
+                              minOccurs="0" maxOccurs="unbounded"/>
+                    </xs:sequence>
+                  </xs:complexType>
+                </xs:element>
+              </xs:schema>
+            XSD
+          end
+
+          it "rejects an element in the disallowed namespace" do
+            doc = ctx.parse(
+              '<container xmlns="http://example.com/w"><stray/></container>',
+            )
+            expect(schema.valid?(doc)).to be(false)
+            expect(schema.validate(doc).map(&:message)).to include(
+              /disallowed by a wildcard \(notNamespace\)/,
+            )
+          end
+
+          it "absorbs an element from an allowed namespace" do
+            doc = ctx.parse(
+              '<container xmlns="http://example.com/w">' \
+              '<stray xmlns="http://example.com/other"/></container>',
+            )
+            expect(schema.valid?(doc)).to be(true)
+          end
+        end
+
+        describe "xs:anyAttribute notQName=##defined" do
+          let(:schema) do
+            ctx.xsd(<<~XSD)
+              <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
+                  targetNamespace="http://example.com/w"
+                  elementFormDefault="qualified"
+                  attributeFormDefault="qualified">
+                <xs:element name="settings">
+                  <xs:complexType>
+                    <xs:complexContent>
+                      <xs:restriction base="xs:anyType">
+                        <xs:anyAttribute processContents="lax"
+                                         notQName="##defined"/>
+                      </xs:restriction>
+                    </xs:complexContent>
+                  </xs:complexType>
+                </xs:element>
+                <xs:attribute name="marked" type="xs:string"/>
+              </xs:schema>
+            XSD
+          end
+
+          it "rejects a declared attribute the ##defined wildcard excludes" do
+            doc = ctx.parse(
+              '<settings xmlns="http://example.com/w" ' \
+              'xmlns:w="http://example.com/w" w:marked="x"/>',
+            )
+            expect(schema.valid?(doc)).to be(false)
+            expect(schema.validate(doc).map(&:message)).to include(
+              /attribute marked is disallowed by a wildcard \(notQName\)/,
+            )
+          end
+
+          it "absorbs an undeclared attribute laxly" do
+            doc = ctx.parse(
+              '<settings xmlns="http://example.com/w" free="x"/>',
+            )
+            expect(schema.valid?(doc)).to be(true)
+          end
+        end
+      end
+
       describe "wrong-namespace root" do
         let(:schema) do
           ctx.xsd(<<~XSD)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: moxml
 version: !ruby/object:Gem::Version
-  version: 0.5.162
+  version: 0.5.163
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-24 00:00:00.000000000 Z
+date: 2026-10-25 00:00:00.000000000 Z
 dependencies: []
 description: |
   Moxml is a unified XML manipulation library that provides a common API